Use existing request object if possible in default_current_user_provider

Recreating the request object from the env can strip important data such as api_key and api_username.  It's still alright for when you want to check on the current user or cookies.

This was discovered when api requests were getting forbidden for no reason.