{% request.user %} is made available to the template through the context processor "django.template.context_processors.request" while {% user %} is made available to the template through the "django.template.context_processors.auth" context processor.

In the end they all refer to the same user object.