Prevent guests being able to log in without password using the impersonate feature.

This is now no longer the case, HOWEVER route guards should still be implemented to restrict impersonation to administrators.