auth: introduce AuthUser.is_default_user attribute

This makes makes a number of checks more readable.

The username of the default user is presently hardcoded to "default" (in
db.User.DEFAULT_USER); this is currently what defines the default user,
and this commit doesn't change that. (Even if the check that defines
is_default_user is a comparison between user IDs and not usernames,
the anonymous_user object used in the comparison is loaded by looking
up the user named "default".)