I guess either way, nothing bad happens, since if the user isn't logged in `get_current_user_id()` returns false and the token lookup fails.