[FIX] core: position of finalization when authenticating

Missed while merging the 2FA: in a mono-db scenario, the request is
bound to a database more or less immediately; however in a multi-db
scenario the current request *may* not be bound to a database by the
time we reach session authentication, this binding is performed *by*
the authentication step[0].

By trying to access an environment (requiring a db) before this
binding is performed, the authentication procedure broke.

We could create the environment by hand, but it seems completely
unnecessary: while there is a bundle of operations to perform in all
cases and a bundle to perform during finalization, they don't seem to
strictly depend on one another (and indeed this separation is already
a reordering of the operations from before), so the finalization can
be performed *after* having bound the current session to a database.

In fact that is closer to the older order: in the pre-totp iteration,
only the binding of the uid was performed before that of the login,
and even it was done after binding the database.

[0] this really is mostly a concern when using this step
    programmatically, as interactively the database selector should
    require selecting (and binding) a database before it's possible
    to log-in

closes odoo/odoo#56093

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>

odoo/http.py

@@ -992,15 +992,15 @@ class OpenERPSession(sessions.Session):
         uid = odoo.registry(db)['res.users'].authenticate(db, login, password, env)
         self.pre_uid = uid
 
-        user = request.env(user=uid)['res.users'].browse(uid)
-        if not user._mfa_url():
-            self.finalize()
-
         self.rotate = True
         self.db = db
         self.login = login
         request.disable_db = False
 
+        user = request.env(user=uid)['res.users'].browse(uid)
+        if not user._mfa_url():
+            self.finalize()
+
         return uid
 
     def finalize(self):