authorize: don't use a vanilla session

To properly support two-factor authentication in authorize(), set up
_session.auth if it's not yet been set up. Undo this afterward so we
don't inadvertently log in.