authentication allways works if the uid is already authenticated
user.authenticate appears to work even if given no password or the wrong password if the user has already authenticated. Let's make user.authenticate fail if the user is already authenticated for this uid. Maybe we need a way for the GUI to discover if this uid is already logged in. What about adding a user.uids() (or some better name) that gives you the list of uids that are currently logged in?
(from redmine: created on 2016-08-22)