auth: use other and better checks than is_authenticated

These are the two only uses of is_authenticated, and we are fine without it.