See parent task and T110414#1578206.
The 'AbortLogin' and 'UserLoadFromSession' hooks are both deprecated. You probably want a SessionProvider similar to the one used by the OAuth extension, and maybe a SecondaryAuthenticationProvider to reject the login if that turns out to still be necessary.