auth: actually use _determine_auth_user argument Fix silly mistake which slipped through the review. (We should not look up the session cookie again, when it's passed as a function argument.)