Fix a regression with the new webapi auth backends.

The webapi auth backends was attempting to short-circuit the actual
authentication in the wrong place, causing an undefined variable to be
looked up. This was breaking requests that included the Authorization
header for a logged in user.

We now check for this in the actual backend, once we have the username.
Release Djblets 0.7.27.