Refuse OPDS logins when CWA accepts every password

A CWA with anonymous browsing can answer an OPDS request whatever the
password, so each password logged a user in to Bindery. Bindery now
tests CWA with a login that cannot exist, and refuses OPDS logins if
CWA accepts it. A login check no longer shares the session of the
account of Bindery. The CWA account stays optional for a CWA that asks
for no login, and a missing account now gets its own message.

tests/test_api.py

@@ -81,6 +81,20 @@ def test_cwa_login(client, cwa):
     assert client.get("/api/stories").status_code == 401
 
 
+def test_cwa_that_accepts_every_login_cannot_check_a_password(client, cwa, caplog):
+    cwa.anonymous = True
+    for password in ("pw", "wrong"):
+        response = login(client, password=password)
+        assert response.status_code == 401
+        assert response.json["error"] == "Cannot check the login with CWA. The log has the details."
+    assert "CWA accepts every OPDS login" in caplog.text
+    assert client.get("/api/stories").status_code == 401
+    # These are not wrong passwords, so they lock no one out.
+    cwa.anonymous = False
+    orchestrator.cwa()._login_test = None
+    assert login(client).status_code == 200
+
+
 def test_a_session_ends_after_one_day(client, cwa, monkeypatch):
     response = client.post(
         "/api/auth/login", json={"username": "reader", "password": "pw", "remember": True}, headers=H