Move reverproxyauth before session so the header will not be ignored even if user has login

Move reverproxyauth before session so the header will not be ignored even if user has login #19251