#247 only access request.user if necessary

to stop Vary: Cookie headers which inhibit caching