login_optional should be the outer-most call, which parses auth headers into request, making it available for instance_request.  This probably applies to other view functions as well.