Auth hooks and `is_admin_bar_showing()` fix

- hook authenticate on `set_auth_cookie` instead of `wp_login` to
account for ajax-based logins. #class-auth
- move `is_admin_bar_showing()` check inside the `admin_head` hook,
otherwise it attempts to trigger before init.