only access request.user if necessary to stop Vary: Cookie headers which inhibit caching
Merge pull request #248 from oppianmatt/master

#247 only access request.user if necessary