Add support for gateway mode

If the gateway_mode option is set to true, rack-cas will attempt
to authenticate the user upon the first request. If CAS then
does not autenhenticate the user, a `cas_anonymous` flag is set on
the session, which prevents further attempts to authenticate the user
in the current session until some request results in a 401 status.

This behavior prevents every public request except the first one from
being redirected to CAS.