now find_remote_user returns user and authinstance that accepted them.

backed out change to user object to store the last xmlrpc auth instance.