Do not clear password until after leaving signin

Closes #3399
* Provide our own authenticate action handler which does not
  clear the password input.
* Use the Signin route's deactivate hook to clear the password
  property on the controller after the user has transitioned
  away from the signin page.
Just for academics, what's the change here do exactly?