I ran into this exact issue with the infinite reauth loop tonight after I had to move a WP site from one domain to the other. What fixed it was making sure siteurl and home matched in the wpoptions table in the databsse. At first it was siteurl = https://www.xyz.com/x-y-z/ and home = https://www.xyz.com/. When I added the subdirectory to the home field it worked fine, it was like the admin was looking in the wrong spot to authorize the user or something. Hope this helps.
