Do not enforce PHP authentication to be present in the REST interface.

- This allows the REST service to be used with the built-in auth without
  special configuration (as for the normal web interface).
- Still check consistency if auth is available.
- Still *enforce* double-submit when external auth is being used.