proper permission checks and setting uid more conservatively

There's a few little things here that are leading to scenarios where users are able to create content that they shouldn't really be able to. I had a situation where e-mails that were not associated with accounts on the site were having content created with "Anonymous" as the author. This was caused by:

1. If an authenticated user manually calls cron then node_object_prepare will stick that user's uid onto the node object
2. Mailcomment uses $node->uid as a way to figure out if an authentication mode has worked or not
3. The node_access check uses the current global $user rather than the user on the node itself

Patch coming soon tightens up the uid and node_access calls to make sure that only real valid content comes through.