Rest auth should just do the same checks as rlm_pap for credentials