Sign-in issues a server session cookie. Tenant context is never taken from the URL.