Allow users to escape 'Not authorized' when their email address is not found on the allow-list

[luisvsm]

Hi, love the project and thanks for maintaining @thomseddon

Okay so, I've run into an issue where a user will authenticate with an erroneous email address and then be stuck on 'Not authorized', I don't think it's anything new, and the issue seems well documented with #147 and #103

The current workflow for remedying the issue currently seems to be to clear your auth cookie manually which is a little bit awkward for end-users.

My goal with this pull request was to create a more user-friendly workflow for allowing the user to retry with a new email address, without degrading any security features of the project.

My intention was as follows:

1. Find the point where a user's email address is checked against the allow list
2. Clear the auth cookie with as much pre-existing code as possible (using the existing ClearCookie function)
3. Give the user feedback, prompting them to try again
4. Set up a config flag that allows for this feature to be turned on or off
5. Default this feature to off as to not affect existing workflows

This is my first time touching Go, so definitely check over my changes.

Thanks again,
Luis