Nice page when no signin permission

This basically tries to log in the user when they hit the app root. If it succeeds they go to the upload page. If it fails it redirects to route but now they have a session. Root has a nice message to tell them they don't have access and a button to retry. When they retry it will re-get the user session stuff from signon and if this now includes the signon permission they will happily go to the upload page.

It's secure because for anything important they will have to hit signon via stagecraft and we'll discover their status outside of the client session then.