autodiscover: the email address given in the request XML is more reliable than PHP_AUTH_USER since mail clients may not have explicitly asked for the username, and there is no need for the two to match