Default value of PERSISTENT_LOGIN_SECURE_PATHS breaks AJAX

One of the paths that users must explicitly log in to access by default is user/*/*. This can break AJAX requests to that path - for instance, when setting the author of a node or comment, an AJAX request is made to user/autocomplete, resulting in a nasty error dialog if the user is only authenticated via PL. This default should be changed, or an exception should be made for user/autocomplete.