autodiscover: the email address given in the request XML is more reliable than PHP_AUTH_USER

Mail clients may not have explicitly asked for the username so PHP_AUTH_USER may not match the user's email address (supplied by the mail client in the request XML). There's no reason the two necessarily have to match. If they don't match, prefer the email address.

This fixes autodiscovery with the stock Email app on android, which passes just the user part of the email address in PHP_AUTH_USER.

(see https://github.com/mail-in-a-box/mailinabox/pull/144)