Error in consent page with ENFORCE_2FA

We get this error on logging in to an instance running the release candidate of 2.15:

'Session' object is not subscriptable

The URL at that point of the login dance is the consent page, and this instance has ENFORCE_2FA on so I'm guessing it's this line:

aal = session['authenticator_assurance_level']
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information