Web2py Authentication Bypass