Not being logged in throws 403 from auth fn, rather than returning false