Remove st dependency and implement session bound return path for auth actions

Assets are now purely served by nginx in production, so no need for st.