Handle not logged in vs unauthorized properly

Currently both do the same thing. This is works for our current implementation of a single user role (teachers), but once we add more roles and specific resources to each, we will want to display some redirect page.

No files or tests are named. Start by locating the current handling for unauthenticated and unauthorized requests, then trace how roles and resource permissions are represented. Done means the two cases have distinct handling and the intended redirect behavior is confirmed for each.

Written by the indexing model from the issue text.