Add an extra xmlrpc endpoint hook.

This will make it more transparent whether the endpoint is for only
authenticated requests.