Automatic auth='user' redirection for unlogged users

opt out with query parameter `?noredirect=1`