Routing constraints handle missing sessions data

Routing constraints should behave appropriately when
`request.env[:clearance]` is not set. That is, the SignedIn
constraint should not match while the SignedOut constraint
should.