fix: avoid leaking sub-session created for '_auth_request' (#789)

Closes #658.
3 files changed