spotify: improve authentication and include trackingId

Remove secretPayload (no longer required now Spotify Play is open to
all) and instead use the home page as the page to load to get the
csrftoken and trackingId.