luci-mod-rpc: fix authentication via query string parameter

Localize the `authenticatior()` and `session_retrieve()` functions into the
`index()` function scope so that they're retained when extracting the
function into the dispatcher bytecode cache.

Also allow access to the global scope since upvalues do not work reliably
due to the out-of-context byte code caching of index functions.

Fixes https://github.com/openwrt/luci/issues/1300#issuecomment-381352765
Fixes feefc600

 ("luci-mod-rpc: rework authentication and session handling")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>