auth: don't ignore login POSTs if already logged in This is probably only rarely a big deal, but ignoring an explicit command seems wrong. This makes it possible to easily re-authenticate - we will need this ...