B12: send a visitor who is not signed in from the upload form to the sign-in (#45)

ddiff --git a/server/http/imports.js b/server/http/imports.js
iindex bf9a14d..5d5ebc7 100644
---- a/server/http/imports.js
++++ b/server/http/imports.js
@@@ -25,7 +25,9 @@ function createImportRoutes(ctx) {
      const upload = async (req, res) => {
          const subject = subjectOf(req);
          const loginUrl = '/auth/login?next=' + encodeURIComponent('/imports');
--        const imports = subject ? await ctx.imports.listFor(subject, { limit: 10 }) : [];
++        // The upload is the person's own: a visitor who is not signed in goes to the sign-in and comes back.
++        if (!subject) return res.redirect(303, loginUrl);
++        const imports = await ctx.imports.listFor(subject, { limit: 10 });
          return page(req, res, {
              index: false,
              title: 'Import a results file',
ddiff --git a/test/imports.test.js b/test/imports.test.js
iindex 32f698d..926c336 100644
---- a/test/imports.test.js
++++ b/test/imports.test.js
@@@ -251,11 +251,18 @@ function multipart(filename, bytes) {
      const alice = t.network.addUser('alice');
      const bob = t.network.addUser('bob');
  
--    await check('the upload form is there and asks for a sign-in', async () => {
++    await check('the upload form sends a visitor who is not signed in to the sign-in', async () => {
          const out = await t.get('/imports');
++        assert.strictEqual(out.status, 303, out.text.slice(0, 200));
++        assert.ok(/\/auth\/login\?next=%2Fimports/.test(String(out.headers.get('location'))),
++            'it goes to the sign-in and comes back: ' + out.headers.get('location'));
++    });
++
++    await check('the upload form is there for a signed-in person', async () => {
++        const out = await t.get('/imports', { as: t.network.addUser('signer') });
          assert.strictEqual(out.status, 200, out.text.slice(0, 200));
          assert.ok(/Import a results file/.test(out.text), 'the page says what it is');
--        assert.ok(/Sign in/.test(out.text), 'it asks for a sign-in');
++        assert.ok(/Inspect AI/.test(out.text) && /Harbor/.test(out.text), 'it names the tools it reads');
      });
  
      let importId = null;