check request.isAuthenticated instead