3.0 auth

Removed setting/unsetting of user record to/from session in AuthComponent.

It's now handled by each stateful authentication adapters itself.
Nope, the `!$request->is('post')` check is there to allow that. So even if you are logged in and post the login form again it won't check for user in session and proceed with normal authentication.