fix(auth): refuse to browse as an account that cannot sign in
An account not approved yet, or one that has to confirm its e-mail first, would be treated by the site as a guest, so browsing as it showed a site nobody sees. The refusal names the reason. RegistrationSettings tells whether the e-mail has to be confirmed and whether an account still has to confirm it.