How to restore $form_state when rebuilding a form after a redirect
I got this working in the end. The solution was:

$form_array = drupal_retrieve_form($cached_form, $cached_form_state);
$form = $form_array['#form_id'];
$block['content'] = drupal_render($form);


where $cached_form and $cached_form_state were the $form and $form_state values that had been stored in $_SESSION. Note that '#form_id' is a literal string, I've no idea why drupal_retrieve_form returns an array with that string as a key. 

This redisplayed the form in the block after the authentication challenge, with the user's pre-challenge selections populated into the form elements. I couldn't get it to work with either drupal_get_form() or drupal_build_form().