`_authenticate` is updating the `env`, but it updated the `env` of
`ir_websocket` instead of `self`. There was then a mismatch between
the `update_context` and the current user.
This was highlighted in another PR that removed sudo from these methods
with the hope on relying on ACL, which depends on current user and other
context values at the same time.
closesodoo/odoo#139436
Signed-off-by: Matthieu Stockbauer (tsm) <tsm@odoo.com>
Sébastien Theys
d15e88abef