auth: actually use _determine_auth_user argument

Fix silly mistake which slipped through the review. (We should not look
up the session cookie again, when it's passed as a function argument.)