Update HB.Session.signIn to modern standards

 * Update signIn to use ic.ajax (and leave redirecting as an exercise for the reader)
 * Remove getAuthToken, signInWithOptionalRedirect (lol) and signIn aliases
 * Change url for signIn to /sign-in to match the signOut path