store Duo auth token in session, not param, when redirecting from Duo auth page to destination