Previously, users could impersonate without being logged in, meaning that they could log in without a password to any user's account.

This is now no longer the case, HOWEVER route guards should still be implemented to restrict impersonation to administrators.
Merge pull request #11 from mtudor/feature/prevent-guests-using-impersonation

Prevent guests being able to log in without password using the impersonate feature.