Apply login decorator before permissions check; less 403s, more 302s

The diff may not be super clear, so my interpretation (and check that this intention matches what you read) is

```
- require_permissions = login_decorator ∘ check_permissions
+ require_permissions = check_permissions ∘ login_decorator
```