Protected experiment access

Some lab projects are open, while others require Google SSO or a specific allowlist. Sign in once and the same access rules will carry across the lab surface.