Add enum to controllers and scripts for session requirements

[fredemmott]

It looks like ANYONE_ON_THE_INTERNET | LOGGED_IN_WEB | ADMIN_WEB | CLI_ONLY might be suitable

[fredemmott]

Current status is that if an endpoint isn't supposed to be ANYONE_ON_THE_INTERNET they need to remember to call stuff on SessionUtils; would be much better to have a secure-by-default design.

[javuto]

This makes so much sense. I had some time to think about this and it will really mitigate right away access to certain endpoints, if the access check is forgotten.

[fredemmott]

#264 is what led to me filing this