Conflict with Profile module (and potentially others)

Webserver_auth sets $user = user_external_load just that it can then see if it got a valid user. If it succeeds, fine. If it fails it does it's magic. The problem is that the magic includes user_save which invites other modules to exercise their hooks on the invalid $user variable. The profile module calls user_access with the invalid $user variable and we get sql errors.

This was already brought to light in a post by:
http://drupal.org/node/109576

I wish I'd seen that before I debugged it myself as well.
/web