(SECURITY) Fix user caching and login checks

Previously, CentralAuthHooks::onUserLoadFromSession left a valid
CentralAuthUser object attached on the User object, even when the
authentication failed. Special:CentralAutoLogin assumed that
CentralAuthUser::getInstance wouldn't return a valid CentralAuthUser
if the user isn't logged in. In combination, these could be used to
bypass authentication.

This patch fixes both issues.

Bug: 52338
Change-Id: Ic132c2cfd581898e7cdedb54aa107535df40be71