Do not clear password until after leaving signin

Closes #3399
* Provide our own authenticate action handler which does not
  clear the password input.
* Use the Signin route's deactivate hook to clear the password
  property on the controller after the user has transitioned
  away from the signin page.