Doing registered user auth check BEFORE checking entity ID, for better security.