3.0 auth

Removed setting/unsetting of user record to/from session in AuthComponent.

It's now handled by each stateful authentication adapters itself.
Right that's bad. So there needs to be a way to convey to FormAuthenticate::authenticate() to try authentication only if called from AuthComponents authenticate()/identify(). Add an extra param to BaseAuthenticate::authenticate() perhaps?

Given that @lorenzo doesn't like moving the persistence management inside the adapter I can reduce the scope of PR and just unify getUser() and authenticate() by adding a way to allow AuthComponent to indicate from where it's calling the adapter's authenticate().