user.is_authenticated isTrue even when not logged in after querying for a user

That’s probably best anyway, to prevent conflict with the context middleware.