Coerce `authenticate_session` arguments to Hash

Calling `#to_h` allows for passing in objects that don't respond to
`Hash#{fetch,except}`, but can be coerced into a Hash.

Chaining `with_indifferent_access` is necessary because
`ActionController::Parameters#to_h` coerces with `String` keys.