Handle guess sign-in cases

Correct.  The only exception is the NotificationsController, which has an extra blacklist in which strictly requires login