code: func adminAutologin(c *router.Context, next router.Handler) {
  	u := auth.CurrentUser(c.Context)
  
  	// Redirect anonymous users to a login page that redirects back to the current
  	// page.
  	if u.Identity == identity.AnonymousIdentity {
  		// Make the current URL relative to the host.
  		destURL := *c.Request.URL
  		destURL.Host = ""
  		destURL.Scheme = ""
  		url, err := auth.LoginURL(c.Context, destURL.String())
  		if err != nil {
  			logging.WithError(err).Errorf(c.Context, "Error when generating login URL")
  			if transient.Tag.In(err) {
  				http.Error(c.Writer, "Transient error when generating login URL, see logs", 500)
  			} else {
  				http.Error(c.Writer, "Can't generate login URL, see logs", 401)
  			}
  			return
  		}
  		http.Redirect(c.Writer, c.Request, url, 302)
  		return
  	}
  
  	// Non anonymous users must be admins to proceed.
  	if !u.Superuser {
  		c.Writer.WriteHeader(http.StatusForbidden)
  		templates.MustRender(c.Context, c.Writer, "pages/access_denied.html", nil)
  		return
  	}
  
  	next(c)
  }
docs: // adminAutologin is middleware that ensures authenticated user is local site
  // admin (aka superuser).
  //
  // On GAE it grants access only to users that have Editor or Owner roles in
  // the Cloud Project.
  //
  // It redirect anonymous users to login page, and displays "Access denied" page
  // to authenticated non-admin users.