Don't preemptively write truthy value to session[:user]

Checks for :herokai_only will fail and redirect the user on first auth attempt,
but on second auth attempt, since session[:user] is a truthy value, apps that aren't
making use of emails or API tokens will happily allow the user access with
session[:user] = true
Merge pull request #13 from heroku/herokai-only

Herokai only