Don't preemptively write truthy value to session[:user]
Don't preemptively write truthy value to session[:user]

Checks for :herokai_only will fail and redirect the user on first auth attempt,
but on second auth attempt, since session[:user] is a truthy value, apps that aren't
making use of emails or API tokens will happily allow the user access with
session[:user] = true

recurser/heroku-bouncer,cbartlett/heroku-bouncer,heroku/heroku-bouncer