Avoid double-counting the /sign_in page when users return from authenticating with their primary.

* Instead of using the #AUTH_RETURN* hash, use ?AUTH_RETURN*, which is sent to the backend and can be used to avoid double count.
* /sign_in?AUTH_RETURN logs an `idp.auth_return` message
* /sign_in?AUTH_RETURN_CANCEL logs an `idp.auth_cancel` message
* Update tests.

fixes #3970
Log new primary users, send info to the kpi backend.

fixes #3985
Update how kpi.send_metrics config item is accessed - the namespace was updated yesterday in dev.
Merge pull request #3971 from shane-tomlinson/issue-3970-sign_in-double-count

Avoid double-counting the /sign_in page when users return from authenticating with their primary.