Determine auth backend from session.

Remove `backend` attribute from users fetched by the authentication
backend and rely on the backend string stored in the user's session to
determine if they were fetched by django-browserid.