don't use request:get-attribute when check for logged-in user - it fails out of request context (e.g. when running setup.xql during installation)