IE7+ will ask for this (opensearch/people and opensearch/notice) on every page access, and as the content is not sensitive, returning it is better than a 307 redirect.
if (!$user && common_config('site', 'private')) {
$public_actions = array('openidlogin', 'finishopenidlogin',
- 'recoverpassword', 'api', 'doc');
+ 'recoverpassword', 'api', 'doc',
+ 'opensearch');
$login_action = 'openidlogin';
if (!common_config('site', 'openidonly')) {
$public_actions[] = 'login';