Exchange a sign-in code

Trades the one-time code the Google sign-in callback put in the dashboard's URL for the same session a password sign-in returns: the access token in the body, the refresh token in its cookie. A code works once, within 60 seconds of the callback, and only in the browser the callback redirected: it must carry the railhook_signin_handoff cookie the callback set.