some tweaks

  protected void SignIn(IIdentity auth)
        {
            if (this.Request.Session.ContainsParameter("auth"))
            {
                this.Request.Session.ClearParameters();
            }

            this.Request.Session.AddParameter("auth", auth);
        }