auth_db: auth_check() to get the auth header from the used api

- this avoids using a different auth header that might be in the request
  before checking usernames in from/to headers against auth user

(cherry picked from commit 4992519eed88d94847d742c52e882082b1b41264)