FIX: don't return 200s when login is required to paths

When running `ensure_login_required` it should always happen prior to
`check_xhr` cause check xhr will trigger a 200 response

app/controllers/draft_controller.rb

@@ -1,6 +1,5 @@
 class DraftController < ApplicationController
-  before_action :ensure_logged_in
-  # TODO really do we need to skip this?
+  prepend_before_action :ensure_logged_in
   skip_before_action :check_xhr, :preload_json
 
   def show