api: set authuser in the thread global request instace - and temporarily verify that it matches what is passed explicitly to auth methods

This makes it more like what middleware / controllers do for "normal" HTTP requests.