A GET to sign in shouldn't extend the session.