"user" is None when no user is connected

(better than checking session data in the views)