See: Http authentication via users service - #2 by adorjani.arpad
This also ties in with this question: Disable two-factor authentication for some users? - #2