Fix handling for user -1 (not logged in)

Fixes #2228.  This turned out to be a much more pervasive problem in how
not being logged in was handled.  I've changed this to closer to how it
should be, that not being logged is is just the same as being user -1,
and its permissions apply, aside from the isLoggedIn function, which was
not actually used correctly either.