auth: consistently use request.authuser - drop request.user

This seems like old tech debt. Now, just get rid of it.