When RemoteUser authentication fails, logout any user

Currently, when `remoteUserBackend` fails to authenticate the
username passed in the header, and `create_unknown_user==False`,
`RemoteUserMiddleware` does nothing. Thus, if a different user
was logged in, that user will remain logged in despite the failed
attempt to log in a new user.

This is a security issue.

We fix this problem by logging out the request if the user returned
by the middleware is None (a failed login attempt).