only short-circuit and return 1 on a noauth-required page if there is no logged in user (oops -- not a bug, per se, right now since none of those pages are auth-optional, but future ones may be, and this caused pointless checking of the current path against every noauth path even for logged in users, which is dumb)