Ah, I see now. I think it's a very common mistake. People also mess up negation when they refactor things like these. So your original was if(!loggedIn) return

Ah, I see now. I think it's a very common mistake. People also mess up negation when they refactor things like these. So your original was if(!loggedIn) return Unauthorized; if(isTokenExpired) return Unauthorized; etc? I think being that explicit about it works pretty well sometimes.