Guard against the request object not having a user attribute in my Who's online middleware. This can happen if a redirect is issued before the authentication middleware gets to run.