encrypt auth_state with MultiFernet

- MultFernet allows key rotation via `AUTH_STATE_KEY=secret2;secret1;secret0`
- Failure to decrypt results in cleared state
- Attempting to set auth_state without encryption is a hard failure
- Absent encryption, auth_state will always be None

jupyterhub/handlers/base.py

@@ -330,14 +330,15 @@ class BaseHandler(RequestHandler):
         if authenticated:
             username = authenticated['name']
             auth_state = authenticated.get('auth_state')
-
+            user = self.user_from_username(username)
+            # always set auth_state and commit,
+            # because there could be key-rotation or clearing of previous values
+            # going on.
+            user.auth_state = auth_state
+            self.db.commit()
+            self.set_login_cookie(user)
             self.statsd.incr('login.success')
             self.statsd.timing('login.authenticate.success', auth_timer.ms)
-            user = self.user_from_username(username)
-            if auth_state is not None:
-                user.auth_state = auth_state
-                self.db.commit()
-            self.set_login_cookie(user)
             self.log.info("User logged in: %s", username)
             return user
         else: