This also corrects the positioning in the chain of the check and removes misuse of prepend_before_action
When running `ensure_login_required` it should always happen prior to `check_xhr` cause check xhr will trigger a 200 response