Return false from authenticate_user and restrict_to when conditions aren't met.