SFTP: login() must be called after getServerPublicHostKey().

Otherwise the password may be given away even if the public host key has changed.

Tested "nothing breaks" on master
Needs backport to stable7
Needs backport to stable6 (and testing nothing breaks)

@PVince81 @LukasReschke