push down user login checking to request handlers