[technoweenie]

You can't send the headers unless you know if the person is authorized or not (and other common things you check in the before filters). So yes, this stuff would have to be checked before rendering a view.

[aaronblohowiak]

I am willing to errantly send a 200 with a js redirect upon auth fail if it means faster load times.