Auth: Handle broken sessions during auth

This should eventually provide a useful error, but a generic 500 is much better
than killing the server.