I think you're guaranteed that they're not logged in by your `before_filter`.