Current Behavior:
When we get the access token for a website visitor, we check if the
`self.env.user` is a public user. If it is, we return his id.
Expected behavior:
We should check the `request.env.user` instead since the visitor can
only be created through the frontend.
opw-2956186
Part-of: odoo/odoo#99181