authorize: don't use a vanilla session

To properly support two-factor authentication in authorize(), set up
_session.auth if it's not yet been set up. Undo this afterward so we
don't inadvertently log in.
Remove unnecessary import and add TODO comments
Merge branch 'pr/198' into develop