Observed via API monitoring.
This corresponds to the case where Win32k creates a window station whose name is based on the logon session identifier for the calling process.
Add also a note about the fact that we need to use a per-session-based WindowStation directory name, as done already in Win32k.
CORE-11933 and PR #621.
Also, improve NtUserSetWindowStationUser() capture order, make psid optional as it should (and avoid a user-mode triggered BSOD), and initialize luidUser only when everything succeeded.
