Replace asserts with HttpResponseForbidden

Hopefully makes failures with the github login approach less opaque to the user.

Errror messages may need more tweaking.