Issue #2213899 by dawehner, joelpittet: Remove global $user wherever possible (outside bootstrap and authentication) Round 2.