Allow anonymous

This PR adds the ability to not enforce authentication on certain requests, which can be configured dynamically with a new optional configuration.

Examples:

```
# Allow anonymous requests to a full site
allow_anonymous: lambda { |_| true }

# Allow anonymous requests to a full site except paths under /admin*
allow_anonymous: lambda { |req| !/\A\/admin/.match(req.fullpath) }

# Allow anonymous requests to the root page, requiring authentication anywhere else
allow_anonymous: lambda { |req| req.fullpath == '/' }
```

This PR includes [PR#17](https://github.com/heroku/heroku-bouncer/pull/17) because both should work great together in public-facing sites: syncing sessions when possible to provide a more consistent UX) but not requiring authentication unless it's really needed. I'll close PR#17 in favor of this one.