Prevent a user to impersonate another one when posting from the extension

> https://github.com/dis-moi/backend/pull/161#issuecomment-787753464
> https://github.com/dis-moi/backend/pull/161#discussion_r585075034

Start by reading the discussion and issue comment linked from pull request #161, then trace the backend authentication path used when the extension posts. Determine how one user can post as another and define the request-level checks needed to prevent that impersonation. Done means extension posts cannot be attributed to an unintended user and the relevant regression is covered by a test.

Written by the indexing model from the issue text.