fixed: _loggedIn() not setting self._authenticated (caused authRequired redirects to always fire, even when logged in)