See parent task and T110414#1578206.
The UserLoginForm and UserLoadFromSession hooks are deprecated. You'll likely want to redo this as a PrimaryAuthenticationProvider, which can integrate properly with the login form instead of having to hack around it.