Do not run authentication if headers already sent

lib/www/server/api/middleware/auth/authentify.js

@@ -44,6 +44,12 @@ async function authorisedHost (req, res) {
 
 async function auth (req, res, next) {
 
+	if (res.headersSent) {
+		// Nothing to do, this request must have been
+		// handled already by another middleware.
+		return;
+	}
+
 	// Check for a valid JWT (already decoded by a previous
 	// middleware).
 	if (req.user) {