Hardened sign-in checks on content submissions

No change to how submitting works if you're signed in — this closes a gap that let a request skip the sign-in screen entirely.