We'd probably want this to be a standard part of _require_login, right? If you don't have an account, you can't really count as logged in?