Add require_login to admin filter. This was exposed as an issue when someone accidentally granted admin to the public. No administrator action ever needs to be performed when not logged in.
Fix remember me checkbox. Conditionally set login cookie discard_p setting based on value of the remember me checkbox when creating or renewing the login cookie.