Stricter check with login_required.

A user deleted from a database will otherwise pass the login_required check, as it's "nil" and not a "GuestUser". (pending that the user already has their cookie and can pass the session check)