Controlled authentication state

Use a seeded account after running migrations and seed data. Until then, protected pages show restricted states instead of broken controls.