auth: change get_allowed_ips to be more resilient when operating on a cached default user

Before, random changes to how things are fetched and cached across database
sessions could cause get_allowed_ips to fail with:

DetachedInstanceError: Instance <User> is not bound to a Session; attribute refresh operation cannot proceed (Background on this error at: http://sqlalche.me/e/bhk3)

Instead, just check for user_id, using same pattern as a bit later in same function.