Security polishing.

 * Require uses to login before accessing anything other than the home
page, login, or password reset.

 * Only show the entities menu to logged in users.