3.0 auth

Removed setting/unsetting of user record to/from session in AuthComponent.

It's now handled by each stateful authentication adapters itself.
Won't this auto login on each post when using formauthenticate? This seems pretty dangerousas every post could change login state.