3.0 auth

Removed setting/unsetting of user record to/from session in AuthComponent.

It's now handled by each stateful authentication adapters itself.
Won't this prevent people logging in with different credentials once they are logged in?