Move reverproxyauth before session so the header will not be ignored even if user has login

[lunny]

When a user logout and then login another user, the reverseproxy auth should be checked before session otherwise the old user is still login.

[KN4CK3R]

Isn't that handled by that code?

gitea/services/auth/reverseproxy.go

Lines 119 to 124 in b36e2ca

	// Make sure requests to API paths, attachment downloads, git and LFS do not create a new session
	if !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) {
	if sess != nil && (sess.Get("uid") == nil || sess.Get("uid").(int64) != user.ID) {
	handleSignIn(w, req, sess, user)
	}
	}

[lunny]

Isn't that handled by that code?

gitea/services/auth/reverseproxy.go

Lines 119 to 124 in b36e2ca

	// Make sure requests to API paths, attachment downloads, git and LFS do not create a new session
	if !middleware.IsAPIPath(req) && !isAttachmentDownload(req) && !isGitRawOrAttachOrLFSPath(req) {
	if sess != nil && (sess.Get("uid") == nil || sess.Get("uid").(int64) != user.ID) {
	handleSignIn(w, req, sess, user)
	}
	}

Not yet. When user hasn't been log out and the reverseproxy send a new user's header. In previous code, Gitea think it has login when checking session and will not check the header any more.