get_current_user returns None if user is not authenticated, because security
leaves current_user.id in the context after logout