bug fixes on authentication

AuthenticatedRequestHandler.user and AuthenticatedRequestHandler.session are now set before AuthenticatedRequestHandler.on_authentication_success() is called.