Do not let anonymous requests use authorized renderer caches

Puts dbuser in params, for correct use by Windshaft renderer cache.
Before this fix, and after commit 1c9f63c9, the renderer cache key
did not contain the db user.

lib/cartodb/carto_data.js

@@ -143,7 +143,7 @@ module.exports = function() {
                     that.getId(req, function(err, user_id) {
                         if (err) throw err;
                         var dbuser = _.template(global.settings.postgres_auth_user, {user_id: user_id});
-                        _.extend(req, {dbuser:dbuser});
+                        _.extend(req.params, {dbuser:dbuser});
                         callback(err, true); 
                     });
                 } else {

lib/cartodb/cartodb_windshaft.js

@@ -17,7 +17,7 @@ var CartodbWindshaft = function(serverOptions) {
 
     serverOptions.beforeStateChange = function(req, callback) {
         var err = null;
-        if ( ! req.hasOwnProperty('dbuser') ) {
+        if ( ! req.params.hasOwnProperty('dbuser') ) {
           err = new Error("map state cannot be changed by unauthenticated request!");
         }
         callback(err, req);

lib/cartodb/server_options.js

@@ -359,7 +359,7 @@ module.exports = function(){
         req.params.interactivity = req.params.interactivity || 'cartodb_id';
 
         req.params.processXML = function(req, xml, callback) {
-          var dbuser = req.dbuser ? req.dbuser : global.settings.postgres.user;
+          var dbuser = req.params.dbuser || global.settings.postgres.user;
           if ( ! me.rx_dbuser ) me.rx_dbuser = /(<Parameter name="user"><!\[CDATA\[)[^\]]*(]]><\/Parameter>)/g;
           xml = xml.replace(me.rx_dbuser, "$1" + dbuser + "$2");
           callback(null, xml);