Fix flaw allowing any user to access any other user's address book

Fixed a flaw with the hmac auth method which would give any user access
to any other user's address book if they are allowed to add their own
carddav servers.