request.user might not exist