heroku/heroku-bouncer — pull request #13 by dominic (2013-09-20 23:48:05+00:00)
Title: Herokai only

Checks for `:herokai_only` will fail and redirect the user on first auth attempt,
but on second auth attempt, since `session[:user]` is a truthy value, apps that aren't
making use of emails or API tokens will happily allow the user access with
`session[:user] = true`.