I see that this assert is elsewhere in the code too, so not really pushing to change it -- but there must be a better way to test a user being logged in than checking for an `_` attribute?