only access request.user if necessary to stop Vary: Cookie headers which inhibit caching