This user factory allows form-based logins to be authenticated against regular user folders
in parent folders. Otherwise, users from, say, the root's acl_users won't be able
to log in via a form
It does this by injecting form-provided credentials into the REQUEST as CookieCrumbler does.