Fix MSAL infinite token-refresh loop

onAuthStateChange listened for both LOGIN_SUCCESS and ACQUIRE_TOKEN_SUCCESS
and called getSession() inside the handler. getSession() invokes
acquireTokenSilent, which itself emits ACQUIRE_TOKEN_SUCCESS, re-entering
the handler indefinitely. Each iteration also fired ensureProfile() in
AuthContext, hammering the API and pegging Safari (the page would never
finish loading and other tabs in the same process would stall too).

Listening for ACQUIRE_TOKEN_SUCCESS is unnecessary anyway: silent
refreshes don't change the user/account. Now we only react to
LOGIN_SUCCESS and LOGOUT_SUCCESS.