Prevent duplicate login iframes/buttons appearing in the sidebar

The main issue here is that the worker was sending SPA connected details, when in fact the SPA might not have been connected. This typically happens in the case where an SPA had been set up, but the cookie had expired (or been deleted, as I used for testing).

Secondary issues were that the LoginView was being rendered whenever the user was changed not just on signin/signout, and additionally there was no prevention to ensure the iframe does not show more than once.

This PR adds additional checks and flags to ensure that we don't send the SPA details to the sidebar unless we're connected, and for the LoginView to handle creation of the iframe better (and only render when really necessary).