Make AT_LOGIN envvar optional

[patcon]

There's no need to require or set AT_LOGIN, since the login must be for the list-owning user, and that can be checked via public API before authentication. So all that's needed is the password :)

Mind if we just make it optional, and when missing, use the owner of the first list provided?

[patcon]

If this sounds ok, we could do a quick check to confirm all the lists are owned by the same user, and raise an error if not, just to avoid weird edge-cases and failures.

[jaseemabid]

Yeah, that makes sense