Index: includes/menu.inc
===================================================================
--- includes/menu.inc	(revision 54)
+++ includes/menu.inc	(working copy)
@@ -509,7 +509,8 @@
 
   foreach (module_list() as $name) {
     if (module_hook($name, 'help')) {
-      if ($temp = module_invoke($name, 'help', $path)) {
+      // We don't invoke hook_help() if encoded # is found in path.
+      if (FALSE === strpos($path, '#') && $temp = module_invoke($name, 'help', $path)) {
         $output .= $temp . "\n";
       }
       if (module_hook('help', 'page')) {
Index: modules/drupal.module
===================================================================
--- modules/drupal.module	(revision 54)
+++ modules/drupal.module	(working copy)
@@ -296,6 +296,10 @@
  * Implementation of hook_info().
  */
 function drupal_info($field = 0) {
+  if (!variable_get('drupal_authentication_service', 0)) {
+    return FALSE;
+  }
+
   $info['name'] = 'Drupal';
   $info['protocol'] = 'XML-RPC';
 
Index: modules/user.module
===================================================================
--- modules/user.module	(revision 54)
+++ modules/user.module	(working copy)
@@ -882,8 +882,8 @@
 function user_auth_help_links() {
   $links = array();
   foreach (module_list() as $module) {
-    if (module_hook($module, 'auth')) {
-      $links[] = l(module_invoke($module, 'info', 'name'), "user/help#$module");
+    if (module_hook($module, 'info') && FALSE !== module_invoke($module, 'info')) {
+      $links[] = l(module_invoke($module, 'info', 'name'), "user/help", array(), NULL, $module);
     }
   }
   return $links;
@@ -902,10 +902,13 @@
     drupal_goto('user/'. $user->uid, 'time='. time());
   }
 
+  // 404 if some trash in path found.
+  if (drupal_strlen($msg)) {
+    drupal_not_found();
+    return;
+  }
+
   // Display login form:
-  if ($msg) {
-    $form['message'] = array('#value' => '<p>'. check_plain($msg) .'</p>');
-  }
   unset($_GET['time']);
   $form['#action'] = url($_GET['q'], drupal_get_destination());
   $form['name'] = array('#type' => 'textfield',
@@ -915,8 +918,10 @@
     '#required' => TRUE,
     '#attributes' => array('tabindex' => '1'),
   );
-  if (variable_get('drupal_authentication_service', FALSE) && count(user_auth_help_links()) > 0) {
-    $form['name']['#description'] = t('Enter your %s username, or an ID from one of our affiliates: %a.', array('%s' => variable_get('site_name', 'local'), '%a' => implode(', ', user_auth_help_links())));
+
+  $user_auth_help_links = user_auth_help_links();
+  if (count($user_auth_help_links) > 0) {
+    $form['name']['#description'] = t('Enter your %s username, or an ID from one of our affiliates: %a.', array('%s' => variable_get('site_name', 'local'), '%a' => implode(', ', $user_auth_help_links)));
   }
   else {
     $form['name']['#description'] = t('Enter your %s username.', array('%s' => variable_get('site_name', 'local')));
@@ -2063,20 +2068,26 @@
       return t('<p>In order to use the full power of Drupal a visitor must sign up for an account. This page lets you setup how a user signs up, logs out, the guidelines from the system about user subscriptions, and the e-mails the system will send to the user.</p>');
     case 'user/help#user':
       $site = variable_get('site_name', 'this website');
+      $output = NULL;
+      foreach (module_list() as $module) {
+        if (module_hook($module, 'info') && FALSE !== module_invoke($module, 'info')) {
+          $output .= "<h4><a id=\"$module\"></a>". module_invoke($module, 'info', 'name') .'</h4>';
+          $output .= module_invoke($module, 'help', "user/help#$module");
+        }
+      }
 
-      $output = t("
+      // Show 404 if no authentication services enabled.
+      if (is_null($output)) {
+        drupal_not_found();
+        return;
+      }
+
+      $output1 = t("
       <h3>Distributed authentication<a id=\"da\"></a></h3>
       <p>One of the more tedious moments in visiting a new website is filling out the registration form. Here at %site, you do not have to fill out a registration form if you are already a member of %help-links. This capability is called <em>distributed authentication</em>, and is unique to <a href=\"%drupal\">Drupal</a>, the software which powers %site.</p>
       <p>Distributed authentication enables a new user to input a username and password into the login box, and immediately be recognized, even if that user never registered at %site. This works because Drupal knows how to communicate with external registration databases. For example, lets say that new user 'Joe' is already a registered member of <a href=\"%delphi-forums\">Delphi Forums</a>. Drupal informs Joe on registration and login screens that he may login with his Delphi ID instead of registering with %site. Joe likes that idea, and logs in with a username of joe@remote.delphiforums.com and his usual Delphi password. Drupal then contacts the <em>remote.delphiforums.com</em> server behind the scenes (usually using <a href=\"%xml\">XML-RPC</a>, <a href=\"%http-post\">HTTP POST</a>, or <a href=\"%soap\">SOAP</a>) and asks: \"Is the password for user Joe correct?\".  If Delphi replies yes, then we create a new %site account for Joe and log him into it.  Joe may keep on logging into %site in the same manner, and he will always be logged into the same account.</p>", array('%help-links' => (implode(', ', user_auth_help_links())), '%site' => "<em>$site</em>", '%drupal' => 'http://drupal.org', '%delphi-forums' => 'http://www.delphiforums.com', '%xml' => 'http://www.xmlrpc.com', '%http-post' => 'http://www.w3.org/Protocols/', '%soap' => 'http://www.soapware.org'));
 
-        foreach (module_list() as $module) {
-          if (module_hook($module, 'auth')) {
-            $output .= "<h4><a id=\"$module\"></a>". module_invoke($module, 'info', 'name') .'</h4>';
-            $output .= module_invoke($module, 'help', "user/help#$module");
-          }
-        }
-
-        return $output;
+      return $output1 . $output;
   }
 
 }