When running `ensure_login_required` it should always happen prior to `check_xhr` cause check xhr will trigger a 200 response
see: https://meta.discourse.org/t/mini-inline-onebox-support-rfc/66400?source_topic_id=66066