Implement os_current_user with a pre-service-hook

[balat]

What about option ~force_unconnected? (may be use a boolean Eliom ref of request scope?)