Make the AS login method call `Auth.get_user_by_req` for checking the AS token. (#13094)

This gets rid of another usage of get_appservice_by_req, with all the benefits, including correctly tracking the appservice IP and setting the tracing attributes correctly.

Signed-off-by: Quentin Gliech <quenting@element.io>