jupyter-server v2 generates new user for each request when auth is disabled

[davidbrochart]

Description

With jupyter_server==2.0.0rc3, launching the server with no authentication:

jupyter lab --ServerApp.token='' --ServerApp.password=''

creates a bunch of messages in the console (maybe one for each request):

[I 2022-10-17 15:38:58.918 ServerApp] Generating new user for token-authenticated request: 705352af6e224d44b191366eab6f3a8b

1. pip install jupyterlab
2. pip install jupyter-server==2.0.0rc3
3. jupyter lab --ServerApp.token='' --ServerApp.password=''
4. See messages as described above.

[davidbrochart]

This causes JupyterLab to be given a different user name periodically through GET /api/me, see jupyterlab/jupyterlab#13432.

[Zsailer]

cc @minrk

[minrk]

I think this stems from the fact that when auth is disabled we avoid setting the login cookie, which is how we persist the anonymous user info. I see two options:

1. set the login cookie when auth is disabled, or
2. continue without cookies, but force a single user object server-side so all requests get the same user model, rather than generating new ones each time

#1076 implements option 1