`before_action`s are run from top to bottom, so `require_login` will have already checked if there is a user