fix unauthenticated error handling code

this commit really fixes three bugs that were all compounding to break
the unauthenticated error handling code:

- fixes a typo calling isUnauthenticated()
- fixes other bugs in that method that were masked by the fact that it
  wasn't being called
- once the code was called, and the message was showing, it was showing
  escaped html, because of a recent fix we did to make flash messages
  more secure to html injection.

we also have now tests covering the first and second bugs listed

this is tricky to test locally because there is a flag that passes all
error through to the default error handler in development, which is nice
because you can see what is breaking in development in a more visible
way, but is annoying because it meant the bugs listed above only
manifest themselves in production.

fixes CNVS-16819

test plan:
** ensure you are in a production environment **

retest commit 00698fc89858f9b86d7b430fdb3a9537e6d2e08e:
- hit a page with an ajax action that is unauthorized: (for example,
  right now there is a bug that causes this if you set the course
  homepage to be the assignment index page and then visit it as a user who
  has a student enrollment in a different class)
- it should show a 'development only' flash error in a development
  environment, and not show any flash error in a production environment

retest commit e45ff7189aee3edefb62de8f087bb6b871b2d1a9:
- in one tab, start to fill out an ajax form (e.g. editing a quiz)
- in another tab, log out of canvas
- return to the original tab and try to submit the form (e.g. save your
  changes)
- should get an error message with a link to login in a new tab
- login in the new tab
- return to the original, and try to resubmit
- should save successfully

Change-Id: I78a2b33a195cb494ea31364fdc4abb27abbe02c2
Reviewed-on: https://gerrit.instructure.com/44241
Reviewed-by: Benjamin Porter <bporter@instructure.com>
QA-Review: Sean Lewis <slewis@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>