The docs aren't entirely clear on this - is there a difference between these variables? On IIS at least they appear to be identical, but I don't want to rely on that if it might be different under other servers.
According to the Adobe ColdFusion documentation they are the same.
http://livedocs.adobe.com/coldfusion/8/htmldocs/help.html?content=Expressions_8.html
Looking at the openbd source code, the remote_user and the auth_user are mapped to the same key, so it returns the same value.
Looking at the railo source code, I'm not quite understanding what is going on, but it appears to be setting remote_user, and I'm not sure if auth_user is being set anywhere.
If you are designing an app that is compatible with coldfusion, railo, and openbd, it appears safer to use remote_user. Maybe someone else can comment because I don't fully understand the code without taking the time to investigate deeply.