Small temporary hack to aid CERN migration. It's enabled only when CERN_CFG_SITE is True. When a restricted collection is searched for, and it exists one and only apache-password enabled role to access this collection, the user is automatically prompted for apache-password like in the previous release, while if there's more of one apache-password enabled role, those roles are proposed, but the login dialog will be hidden.