whoops, request.user doesn't mean user is authenticated