only access request.user if necessary to stop Vary: Cookie headers which inhibit caching
(cherry picked from commit 0b53c36e1188dbc127354467e1281cd2d1b3aee0)