Avoid double-counting the /sign_in page when users return from authenticating with their primary.

* Instead of using the #AUTH_RETURN* hash, use ?AUTH_RETURN*, which is sent to the backend and can be used to avoid double count.
* /sign_in?AUTH_RETURN logs an `idp.auth_return` message
* /sign_in?AUTH_RETURN_CANCEL logs an `idp.auth_cancel` message
* Update tests.

fixes #3970