Switch to using the new `web/authenticate` endpoint

This PR prepares for the API changes by providing a simple, sane default. The web/auth endpoint is being deprecated in favor of the new all-in-one iframe at web/authenticate.