Add a `/sign-out` endpoint that deletes the auth cookies

[scotttrinh]

This shouldn't rely on any providers: they all work by setting the auth token cookie, so signing out is just removing this cookie in response to an HTTP GET.