Fix SQL injection auth bypass in /rest/user/login (bind parameters)

Fix SQL injection auth bypass in /rest/user/login (bind parameters) #557