The problem is that when you have a reference, $foo, that points back to some other data structure, such as @bar or %blat, you can only affect that original data structure by dereferencing $foo:

@bar = qw( one small step for man );
$foo = \@bar;
$foo->[1] = "big";
print "@bar";  # one big step for man
[download]

If, instead, you re-assign to $foo, you've overwritten the fact that $foo is a reference:

@bar = qw( one small step for man );
$foo = \@bar;
$foo = [qw( one big step for man )];
print "@bar";  # one small step for man
[download]

So, in your second function, even though $hash is a reference to the hash you're passing the function, you then overwrite that variable entirely, destroying the reference (but certainly not the underlying data). Your module's function should take a reference as an argument:

sub tie_session {
  my ($hash) = @_; 

  eval {
    tie %$hash, 'Apache::Session::File', undef, {
      Directory     => $r->dir_config('Blah'),
      LockDirectory => $r->dir_config('Blah'),
    };
  };
  return $@ if $@;
  return $hash;  # not actually necessary, but it returns true
}
[download]

which would be called like so:

sub function {
  my ($hash) = @_;
  MyModule::tie_session($hash);
  $hash->{auth}->{user} = "jacques";
}
[download]