Authenticate user only when needed

[marein]

Currently, anonymous users are authenticated with each initial request. A better idea would be to authenticate an anonymous user only when needed, for example:

return !$request->isMethodSafe() && $this->tokenStorage->getToken() === null;

instead of

$this->tokenStorage->getToken() === null;

in ArrivalAuthenticator (former AssignUserIdOnKernelRequest). With this logic, an arrival would only happen with write http requests. The frontend has to be adapted for this, because the information that the user is authenticated is only displayed after a refresh. This would be possible by adding a response header or having the frontend actually make a request for authentication, e.g. to /arrive, before the first write request. An additional advantage would be cachability and that no users are created when bots crawl the page.