applies the fix mentioned on WP-API#9. I dont think we need to check for multisite because wp_authenticate_spam_check itself does that check

Author: Mike Nelson

basic-auth.php

@@ -33,10 +33,12 @@ function json_basic_auth_handler( $user ) {
 	 * filter during authentication.
 	 */
 	remove_filter( 'determine_current_user', 'json_basic_auth_handler', 20 );
+	remove_filter( 'authenticate', 'wp_authenticate_spam_check', 99 );
 
 	$user = wp_authenticate( $username, $password );
 
 	add_filter( 'determine_current_user', 'json_basic_auth_handler', 20 );
+	add_filter( 'authenticate', 'wp_authenticate_spam_check', 99 );
 
 	if ( is_wp_error( $user ) ) {
 		$wp_json_basic_auth_error = $user;