Improve dev/prod parity around Shibboleth sign-in

Handle redirect inside a Rails controller instead of having it be
handled by Apache.

Only enable signing in via Shibboleth if the `SHIBBOLETH_LOGIN_HANDLER`
variable is set. Don't render the form to the user if the variable is
not set.

To simplify conditional styling, swap placement of Touchstone/Shibboleth
form and form to sign in via `devise`.
Only sign in user via Shibboleth when visiting login page

Pass login page as `target` query parameter to the Shibboleth login
handler that instructs Shibboleth to redirect to the specified URL after
a session is created.
Remove local Shibboleth session after

After sign out via devise, redirect to the Shibboleth logout handler
with the `return` query parameter to redirect back to the home page
after Shibboleth removes the user's local session.