When running `ensure_login_required` it should always happen prior to `check_xhr` cause check xhr will trigger a 200 response