Fix AuthCheck.propose_login

We now propose login if all permission refusals are due to not being
logged in or not being a member of this instance.

This is relevant due to the more restrictive membership checks in
5205fa1db0a11b42b0a3db80cb5ad5ed6917577d and
4cfefbe2920f276357462da424a8d7baa038d0e7.

Practically this means that by default the "new proposal" button / link
is now displayed again for non-logged-in users, and that if they visit
`/proposal/new` (that link), they're now redirected to the login page
instead of getting a 403.