ServiceStack/ServiceStack — pull request #390 by Its-Tyson (2013-01-04 13:00:29+00:00)
Title: Auth request may ignore session's ReferrerUrl property.

IAuthProvider.Authenticate implementations may change the current session [(e.g. CredentialsAuthProvider)](https://github.com/ServiceStack/ServiceStack/blob/master/src/ServiceStack.ServiceInterface/Auth/CredentialsAuthProvider.cs#L84-L88).

However after this call [AuthService then uses the old session instance and accessed the old ReferrerUrl property](https://github.com/ServiceStack/ServiceStack/blob/master/src/ServiceStack.ServiceInterface/Auth/AuthService.cs#L154).

This fix addresses the issue by passing the session instance by reference into the Authenticate method. While I like this as it makes the fact that the session instance may change explicit as part of the method signature, I appreciate it may be a breaking change for 3rd party and derived IAuthProviders and you don't want to pull it. In that case a simple workaround is for the [AuthService to just get the current session again after the Authenticate call](https://github.com/Its-Tyson/ServiceStack/blob/simple-auth-session-workaround/src/ServiceStack.ServiceInterface/Auth/AuthService.cs#L153-L154).