Preserve POST authorization through login

Guest POST to authorization endpoint lost body parameters (`client_id`, `redirect_uri`, `state`) before resuming, breaking the OAuth flow.