auth: don't ignore login POSTs if already logged in

This is probably only rarely a big deal, but ignoring an explicit command seems
wrong.

This makes it possible to easily re-authenticate - we will need this ...