3.0 auth

Removed setting/unsetting of user record to/from session in AuthComponent.

It's now handled by each stateful authentication adapters itself.
I don't think it should ever autologin, we did that in 1.x and it was terrible.