Also check for user before setting multi auth cookies

[ekzyis]

While reviewing #1904, I noticed checking req && res to detect if it's a login is weird. Not sure why I did that since next-auth already gives us a way to detect logins:

The arguments user, account, profile and isNewUser are only passed the first time this callback is called on a new session, after the user signs in. In subsequent calls, only token will be available.

-- https://next-auth.js.org/configuration/callbacks#jwt-callback

So I moved the code into the existing if (user) block and tested that we can still:

1. login
2. add a new account
3. logout (until full logout)

Authentication is critical piece of code so to keep the if (req && res) check might make sense but req is definitely set (we also access it above) so I only added if (res). res should also always be set ... but only afaict.

Update

Changed my mind regarding this PR, see #1941 (comment)

[Soxasora]

It's the right place and the right logic, every action of authentication with Next Auth brings with itself res

stacker.news/pages/api/auth/[...nextauth].js

Lines 435 to 437 in 090203b

	export default async (req, res) => {
	await NextAuth(req, res, getAuthOptions(req, res))
	}

so that's always available at login/signup for sure, still think that if (res) doesn't hurt.

By adding res to graphql's polling of getServerSession/getAuthOptions we would take this even further and implement a cleaner way to refresh tokens for logged-in users since we wouldn't have user (no authentication action), actually super cool!