Do not clear password until after leaving signin

Closes #3399
- Provide our own authenticate action handler which does not
  clear the password input.
- Use the Signin route's deactivate hook to clear the password
  property on the controller after the user has transitioned
  away from the signin page.
Merge pull request #3408 from jaswilli/issue-3399

Do not clear password until after leaving signin