Only load user from session if other auth mechanisms aren't present.

web/includes/auth.php

@@ -263,8 +263,6 @@ if ( ZM_OPT_USE_AUTH ) {
   } else {
     // Non token based auth
 
-    $user = userFromSession();
-
     if ( ZM_AUTH_HASH_LOGINS && empty($user) && !empty($_REQUEST['auth']) ) {
       $user = getAuthUser($_REQUEST['auth']);
     } else if (
@@ -280,6 +278,9 @@ if ( ZM_OPT_USE_AUTH ) {
         return;
       }
       $user = $ret[0];
+    } else {
+    $user = userFromSession();
+
     }
 
     if ( !empty($user) ) {