Enable both authenticated and unauthenticated sign endpoints when valid

The authsign endpoint is currently not very flexible. NewAuthSignHandler requires that all profiles loaded have an authentication provider. We should support both endpoints, but only if there are profiles that make sense for each.
- the authsign endpoint should only be available for profiles that have an authentication provider, and disabled if no profiles have one.
- the sign endpoint should only be available for profiles that do not have an authentication provider, or have an authentication provider and a remote signer.