KILL checks user (not priv_user) and doesn't verify hostname

KILL allows the user to kill their own connections, but not connections of other users.

The check for "own connections" only compared username part of USER(), instead of comparing CURRENT_USER fully, thus two different accounts with the identical username part were able to kill each other connections.

Reported by Andrew James Gonzalez