check auth token when getting user

[RayBB]

Blocking: internetarchive/openlibrary#11815

Before this pull request, when fetching a user we first checked whether a cookie was set. The purpose of that check wasn’t to use the cookie itself, but simply to avoid making a user request when no authentication information was present.

In practice, though, we never use the cookie after that check. Authentication actually relies on an auth token that’s already attached to the connection, and that token may have originally come from a cookie earlier in the flow.

This becomes a problem in the FastAPI code path: web.cookie is not set there, so the cookie check fails, even though the auth token is present and valid.

[cdrini]

We tested on testing that it login works, and following the code of _conn.get_auth_token , this does look logically equivalent. A bit nervous, but @RayBB has tested thoroughly, and easy enough to undo!