don't autologin with email request or require login for sendApproval

this takes care of some weird situations switching from supervising to filling out grants