Also use OC_User::isLoggedIn to check if new authentication is needed for grouplist.php and userlist.php
For validateuser.php, credentials are always needed.
Info about which groups the users belong to are also in the user list. Both files need logging in through GET because unauthorized users are not allowed to see this data.