Wrong identity fetched and missing auth calls

[mworrell]

In https://github.com/driebit/ginger/blob/master/modules/mod_ginger_base/controllers/controller_auth.erl#L100 the function claims to return some identity information for an user with id Id. In fact it is returning the identity with id Id, which probably belongs to a completely other user (and might even contain secrets that shouldn't be shared).

user(Id, Context) ->
    #{ <<"identity">> => proplists:delete(propb, m_identity:get(Id, Context))
     , <<"resource">> => m_ginger_rest:rsc(Id, Context)
     }.

Besides that this controller authenticates an user by setting internal Zotonic properties in the session. This bypasses the z_auth:logon_pw/2 or z_auth:logon/2 routines.

The internal routines should be called, as they enable observers to hook into the login process and correctly initialize the session and/or set cookies (an example is the device-id for rate limiting).