DEV: Add `session` to `before_auth` and `after_auth` hooks (PR #13123)

This allows plugins to store/modify things in the session (e.g. the destination_url). This change is backwards compatible with existing plugins. If they do not specify a third argument, they will just be passed the first two.


(example use: FEATURE: Allow an invite link to be included in the LTI custom data by davidtaylorhq · Pull Request #6 · discourse/discourse-lti · GitHub)