add publicuser

[gtsteffaniak]

this adds a special user case for shares and public api calls. Instead of using a db user, its an in-memory user that only has fs permissions to match the scope of the share.