We log this twice. Maybe `is_authenticated()` should do it?