api/auth/auth: fix panic due to setting Session into User context