We should always have a request.user object, even if None.