authentication bug fix

AuthenticatedRequestHandler.user and AuthenticatedRequestHandler.session are now set before AuthenticatedRequestHandler.on_authentication_success() is called