user: require login for new user creation

This way, a non-logged in user typing in fido/users/new will not be
presented with a nil nomethod error (this happened before because we did
not guard against being logged in for the users/new action).