logged in.  Since they haven't logged in, we don't know what they will
be allowed to do.  And users who disable cookies tend to pretty often
not be logged in.