This logic is repeated everywhere.. perhaps move it into a utility function called "authenticated"?

```python
def authenticated():
    return hasattr(flask.g, 'fas_user') and flask.g.fas_user
```

and then elsewhere:

```python
if not authenticated():
    return False
```