Improve authorization user experience

* Don't fail if there is no logged-in user
* Redirect and display a flash message if a user lacks permissions