Don't use internal_password to authenticate when using OpenID SSO.

Logging the user linked to the ExternalAuthMap directly doesn't seem to be
any less secure than authenticating using the internal_password,
which is giving us headaches when trying to port existing users to external OpenID auth system.