A few authorization fixes

• Auth codes can't be empty, so it doesn't make sense to allow users to get accidentally stuck here.
• Only clear page stack when login is successful. This prevents odd situations where you enter the wrong auth code and are forced into the application (this bad state isn't saved fortunately.)