SECURITY: when enabled_local_logins is false users could log in via API

thanks @Nicholas Blanco