Remove redundant user() functions

Remove redundant user() functions

The child classes of AuthUserRequest turned out to have alternative
verions of user() set and get functions. These did the same operations
but stored the AuthUser class in different locations.
This makes user() always NULL for pointers to the parent object inside
the core authentication code. Regardess of whether an AuthUser was set.

Also digest auth had a completely alternative set of functions authUser()
to do user() operations on the parent object and locking. This has been
cleaned up.