signed_in? should not call current_user.