Use multi-authentication policy

Mainly done to enable the use of WMS/WFS services in desktop applications with HTTP basic auth.
validate_user does a query already. You need to do it twice.