This will significantly improve security of pages with invalid login checks.

Very often developers forget about the $CFG->forcelogin, all pages (except the login page, signup and error page) MUST use require_login() when forcelogin enabled.