add access restrictions

[bjmllr]

• At first, you can't access anything except the login page.
• When you log in, you are in "staff mode" and can access all pages.
• When you go to the welcome page, you will be placed in "welcome mode" and only able to access pages related to the guest sign-in workflow.
• Once in "welcome mode", the only way to exit is to clear your browsing data.
• This change does not include a "log out" route.