Core/WorldSession: Added research notes about CMSG_AUTH_SESSION values and reordered checks during login to always initialize encryption first to make sure the client can read failure packet