Implement guest sign in and constraints

@gabebw @jsteiner


we prefer to name before filters that do redirects `ensure_...` or `require_...`, so `ensure_admin` or `require_admin`