No auth check in UserController.feed_redirect/2, even on non-federating instances.