api: hide request.user from api functions

Using request.user is not safe and insecure.  Authentication used should
be done by the api, not by Django.

Disallow this from api code to protect it from possible inadvertant use.