LDEV-3335: Put UserDTO in session as soon as possible after authentication, so it is available after redirect. Response is sent by a different thread than SsoHandler and if it wins the race, index page is rendered with UserDTO missing, resulting in error.