Also use OC_User::isLoggedIn to check if new authentication is needed for grouplist.php and userlist.php For validateuser.php, credentials are always needed.