make sure we always have a user object in the context

fixes https://app.getsentry.com/gratipay/gratipay-com/group/45029122/
save a little memory
fix potential timing attack