security fixes: use GeoServerUser, fix tests

securedaccesstests were disabled probably from the initial port
to the new security system. much of this commit fixes that but also
adjusts the cookie filter to be before the anonymous filter. instead
of just using a string for credentials, we use a GeoServerUser
follow up to d3b84999, log auth, adjust tests + db client
fix mix up with principal/credentials