This should be a `leap_check` instead of a `leap_assert`... or may be it shouldn't even fail. A user of the backend might call this before `login`, so the backend should inform in some way that it can complete the call, and a reason for it.