3.0 auth

Removed setting/unsetting of user record to/from session in AuthComponent.

It's now handled by each stateful authentication adapters itself.
It won't auto login for each post but yes currently you would be able to post the username, password fields for any url and get authenticated. Guess there needs to be check in `FormAuthenticate::authenticate()` to do authentication only if its post request for login action.