This reduces chances of errors where consumers of strings mutate inputs and reduces memory usage of the app. Test suite passes now, but there may be some stuff left, so we will run a few sites on a branch prior to merging
This also corrects the positioning in the chain of the check and removes misuse of prepend_before_action
When running `ensure_login_required` it should always happen prior to `check_xhr` cause check xhr will trigger a 200 response