Single instance of handler and authentication class mixes users

[austein]

Both jsDAV_Auth_Backend_AbstractBasic and Digest classes use a currentUser to store the current successfully-authenticated user. If two users make concurrent requests, the latter's authentication is stored and used for the first user's request. DAVACL will check for permissions and reject the first request once currentUser is set to the second user.

Tested using Mac OSX Yosemite's Contacts with two accounts setup pointing at localhost. Restarting Contacts will cause one or both to fail depending on how the race condition plays out

[mikedeboer]

Very true! Pull Request super welcome!