>>It seems backward to me. You know user already so you can decide upfront wich actions are allowed.
>
>Not if the user is not logged.

Sure you do. If user is not logged in than it's Anonimous user with appropriate rights.