auth_http_remote_user: test if already authenticated based on login instead of uid

Avoids a database query unless authentication is actually required.