Move back to forcing signin by default.

`require_signin_permission!` implies `authenticate_user!`
Check host from an env var instead of hard coded.