Herokai only

Checks for `:herokai_only` will fail and redirect the user on first auth attempt,
but on second auth attempt, since `session[:user]` is a truthy value, apps that aren't
making use of emails or API tokens will happily allow the user access with
`session[:user] = true`.