Fix for bad `request.user` property access

We really need to ditch some of the uglier parts of horus, maybe just
preserve the models until we can migrate and sanitize the view stuff
we've got hacked all over the local auth.