change of getAuthSession() in AuthorizationBaseServerResource.java

When redirecting from the auth_page it will set the cookie but it will not be available yet after the redirect. It is however present in the attributes of the request. This causes NPE in certain cases.

We noticed that in previous version of this extension it was indeed fetched from the attributes from the request. It fixed our problem we were having.