R1:3b5883d8c1ee

Fix an issue with embedding slowvotes

Summary:
In some applications, using `{V2}` syntax to embed a vote throws. The chain of causality looks like this:

- We try to render a `phabricator_form()`.
- This requires a CSRF token.
- We look for a CSRF token on the user.
- It's an omnipotent user with no token, so everything fails.

To resolve this, make sure we always pass the real user in.

Test Plan:
- Lots of `grep`.
- Made a Differential comment with `{V2}`.
- Made a Diffusion comment with…