[troyb]

Here are the things that the updater does...

Downloads the disk image for the latest version via http.
Mount the disk image.
Rename and move the old copy of OmniWeb to the trash.
Move the new copy of OmniWeb from the disk image to the location of your old version.

It's likely one of these processes causing the authentication request. I'm not sure which but you might be able to get a better idea of which by looking at when the authentication appears.

As for you session not getting restored, you might check on OmniWeb's auto-save setting to make sure it's still storing your session.

In the workspaces menu, select "Show Workspaces"
In the window that appears, make sure "Auto-save while browsing" is selected.