Sign out of active authentication sessions on Identity removal or dtor

Previously, active authentication sessions would remain valid after an
identity was removed or destroyed.  This change ensures that any active
auth sessions are signed out of prior to removal, and that the single
active session owned by the current instance is signed out of when the
instance is destroyed.  It also ensures that the auth session's state
change signals are connected properly, and adds unit tests to ensure
that we don't regress.