FIX: don't return 200s when login is required to paths

When running `ensure_login_required` it should always happen prior to
`check_xhr` cause check xhr will trigger a 200 response

spec/controllers/wizard_controller_spec.rb

@@ -14,6 +14,13 @@ describe WizardController do
       expect(response.status).to eq(403)
     end
 
+    it 'needs you to be logged in' do
+      get :index
+      # for whatever reason, no access is 404
+      # we may want to revisit this at some point and make it 403
+      expect(response.status).to eq(404)
+    end
+
     it "raises an error if you aren't an admin" do
       log_in(:moderator)
       get :index, format: :json