Herokai only

Checks for `:herokai_only` will fail and redirect the user on first auth attempt, but on second auth attempt, since `session[:user]` is a truthy value, apps that aren't making use of emails or API tokens will happily allow the user access with `session[:user] = true`.