It turns out that every user is using the 'mahara' institution's internal auth plugin, despite the fact that if they're in a different institution they shouldn't be able to use it. Fix this by creating internal auth plugins for all institutions that need them, and fixing the 'authinstance' field of the usr table.