Auth Shield and multilanguage

There were two points I was making:

1. To modify the session use the helper

You did that: session()->set('locale', $this->request->getLocale());
However, because you initially wrote: $this->session = Services::session(); the prior line should have been: $this->session->set('locale', $this->request->getLocale());
You're using two different techniques to access the session, making the first technique where you've created a protected variable for the session object superfluous. Why access it that way if you'll end up using the helper anyway (which also initializes the session if it needs to)?

2. Content Negotiation is automatic

Your code is set up to do content negotiation automatically: $lang->setLocale($this->request->getLocale());
This implies that the language will ALWAYS be set based on what the browser sends i.e. setting automatic content negotiation to true has the same effect.
You've implied that certain things change are deduced on your application based on the locale, this can always be accessed using the request object so there is no need to store it in the session: service('request')->getLocale();
However, you've also stated there is a dropdown of some sort, presumably to allow the user to change their language from the frontend and thus the need to store it in the session. Assuming that's the case then your prior code for setting the locale should be: $lang->setLocale(session('locale'));
This makes it so that the user's choice of language is the one that dictates how Content Negotiation is handled.

When it comes to Content Negotiation you use one or the other (automatic or user set) i.e. they are mutually exclusive.

Halberd | CodeIgniter Sandbox