There's an argument in favor of explicitness: we have an unusual control flow, and it's easier to follow when you can see how it's threaded.

Using an EnvironmentVariable would mean that in theory any function a login handler called could set the known user id, so there would be more places to look to see where it is being set.