request.user is always True