Return unauthorized when AddToProgress is true and user is not logged in

[dfederm]

And then on the client side, open the log in dialog when this happens.

This will prevent users from thinking they added to their progress when they got logged out.