"Access Denied" after account creation when using ldapauth and securesite

On a site running pathauto, ldap_integration, and securesite, new users initially receive an "Access Denied" page when trying to access the site home page on initial account creation/log in. Reloading the page makes it display fine. I've traced this problem back to (possibly) pathauto. For securesite and ldap_integration to work well together, I use the patch from http://drupal.org/node/97197#comment-467296. Thus, the user registration process goes something like this:

1) User accesses site
2) User gets HTTP auth dialog
3) User submits credentials
4) Securesite.module calls _ldapauth_user_authenticate(), which is pretty much like user_authenticate, but without requiring @address in the user name for external (LDAP) users
5) _ldapauth_user_authenticate() calls _ldapauth_save_user(), which calls user_save()
6) user_save() fires hook_user(), which fires pathauto_user()
7) pathauto_user() calls pathauto_create_alias(), which calls _pathauto_set_alias(), which calls _pathauto_path_is_callback(), which calls menu_get_menu()
8) menu_get_menu() builds the menu (and associated permissions), but *doesn't* use the normal user access checks and does some magic instead

So, it's really somewhere in menu.inc where the permission fails (and I can't figure out which permission it is). The problem seems to be that the global $user isn't updated until after user_save() returns, which won't happen until after the menu is built. At that point, the user has already been denied access, thus they can't access the site without reloading the page.

My current work-around is to add a 'global $user' in user_save() before hook_user($op = 'insert') is fired. Thus, the global $user variable (used by the menu code) has the current user object before user_save() returns and everything works fine. But that's a big, ugly hack and I'd rather find a better solution.

Granted, I'm not sure this problem is in pathauto, but it does trigger it. Disabling pathauto solves this issue.