Call #can_be_used_by? only if there is a logged-in user

This should prevent exceptions like we saw in #88568