Fixed default IAM policy documents in cn-north-1.
Comments about where else to update code.
Fixed ``get_signin_url`` behavior.

This is pretty much broken right now. This improves it & should make cn-north-1 work correctly now as well.
Merge branch 'iam-improvements' into develop

Fixes #2152.