Simplify login by passing session data to onlogin

This simplifies the login cycle by using the user's session data (rather
than merely their CSRF token) as their identity.

The user's session data contains the userid, so it seems awkward to
throw this away and then use the CSRF token as their "identity",
requiring an additional round trip via the token server before
AppController gets to know their userid.

Instead, use data directly from the session and don't wait for the token
before setting up the Permissions plugin.