Use the new all-in-one `web/authenticate` endpoint

This PR prepares for the API changes by providing a simple, sane default. The `web/auth` endpoint is being deprecated in favor of the new all-in-one iframe at `web/authenticate`.