[1.6.x] Fixed #20673 -- Clarified that HttpRequest.user uses AUTH_USER_MODEL.

Thanks littlepig for the report.

Backport of f407f75aae from master.