Introduce `User::can()' for checking whether a user has a given permission

The authentication manager already has the `hasPermission()' method but it lacks wildcard support
and uses stupid looping. Implementing this method on the user further saves a call to `User::getPermissions()'.
Use `User::can()' in `hasPermission()' of the authentication manager
autologin: Don't use `count()' for is empty checks

Using `count()' in favor of `empty()' for empty checks on arrays is bad habit.
While there's literally no performance gain in the "fixed" scenario, there's one on large arrays
and thus should be avoided everywhere.

refs #6462
autologin: Fix externally-authenticated users still being authenticated after external authentication is disabled

The if condition for revoking authentication if the username changed relied on having the `$_SERVER' variable set which was used for authentication.
Authentication is now revoked if the username changed or external authentication is no longer in effect.

refs #6462