I think requires_login() -- and possilbly requires() -- assumes that the login page is in the default/user. Should this URL be auth.settings.login_url ?
I don't have authentication in default/user, so I have to redirect to the appropriate place if a user tries to access a page that requires login.
