Applications must have signin permission

we need this explicit record in supported permissions
so that admins can control whether it can be delegated.

1. a migration to create 'signin' supported permission
for apps where it is not present already.

2. after_create callback to create this permission for
applications created now onwards.