FIX: don't return 200s when login is required to paths

When running `ensure_login_required` it should always happen prior to
`check_xhr` cause check xhr will trigger a 200 response

spec/requests/admin/admin_controller_spec.rb

@@ -4,5 +4,8 @@ RSpec.describe Admin::AdminController do
   it "should return the right response if user isn't a staff" do
     get "/admin", params: { api_key: 'asdiasiduga' }
     expect(response.status).to eq(404)
+
+    get "/admin"
+    expect(response.status).to eq(404)
   end
 end