Block Logins with the Authenticate Filter

Rather than with `login_init`. Makes Simple Login Lockdown work for
XMLRPC as well as the normal login.