Fix AttributeError on unauthenticated OPDS requests

request_username() is used as flask-limiter's key_func for the OPDS
blueprint. The limiter evaluates key_func in a before_request handler,
before the route's auth decorator runs. When no Authorization header is
present, request.authorization is None, causing an AttributeError and
a 500 response instead of the expected 401.

Guard against None so unauthenticated requests fall back to an empty
string key, allowing the auth decorator to handle the 401 correctly.

Fixes #3592

Disclaimer: AI assisted—humans supervised.

cps/main.py

@@ -24,7 +24,7 @@ from flask import request
 
 
 def request_username():
-    return request.authorization.username
+    return request.authorization.username if request.authorization else ""
 
 
 def main():