test REMOTE_USER  does not authenticate

if external (and all other methods) are missing  this test ensures
that  a request with REMOTE_USER set  that the token would come
through as unauthenticated

Change-Id: I08a0117773bd4efd8e220306de7ba82df73f7403
Merge "test REMOTE_USER  does not authenticate"