EZP-22479: Ignored subrequests, including fragments

Authorization check on user/login must be made on the master request only.
It avoids ESIs or Hincludes to display the login form themselves (inception!).

HttpKernelInterface::SUB_REQUEST (inline) and fragments (ESI/Hinclude) are concerned.