registry: don't require username when validating

Checking `user` should be enough to verify if user is logged or not.

Issue with this check arose when replicating public npm registry to a
public one. When using `_replicator` database it is not required to
define username for replicator's `user_ctx` (`{ "roles": ["_admin"] }`)
is enough.

`userName` variable isn't used further down either.