Use case-insensitive comparison in session_changed.

Redmine login name is case-insensitive, so the previous
code could cause issues when different upper case and lower
case characters are used in the authentication layer.

This commit hopefully fixes 'invalid form authenticity token'
issues.

lib/http_auth_patch.rb

@@ -75,7 +75,7 @@ def session_changed?(user, remote_username)
       if user.nil?
         true
       else
-        use_email? ? user.mail != remote_username : user.login != remote_username
+        use_email? ? user.mail.casecmp(remote_username) != 0 : user.login.casecmp(remote_username) != 0
       end
     end