Fix site not found 404 page

This page was giving an error when accessed because the authorization
middleware wasn't being loaded early enough so the 'userCan' helper
wasn't available in the template. To avoid this I've moved the auth
middleware up the stack so it's already done when the instanceSelector
runs.

This has required a small change to the deserializeUser method so that
it doesn't depend on 'req.popit' being available, since the
instanceSelector middleware is now run after the auth.
Prevent basic auth login appearing when creating user

This was trying to authenticate with basic auth, even if the user was
already authenticated with a cookie.