removed security token requirement for login

This was discussed a while ago on the mailing list. We want to work cross-site
logins keep working.

darcs-hash:20080208200733-7ad00-a1f6164d65001586ec23311c07fe5c277bd62a82.gz