Authentication is saved into session before servicing HTTP requests. Fixes #375.