fix to issue 43; auth.User was not injected on empty HTTPAuthUser