OOIION-865

Show a sign-in dialog when a user's session has expired.
When developers use the /signin bypass, the valid_until session attr is set to now() + 12h.  The 12h is hard-coded and should match what a real certificate returns.
A user's state is checked as part of the /session/ poll.  Once a user sees the dialog, the polling stops.
Clicking sign-in takes them to the same place that the main page's sign-in button goes.  It will not return you to where you left off.
Clicking cancel simply closes the dialog.