login_required decorator doesnt work, flask-Login permits anonymous users

I decorated a method with login_required, but I am surprised that its not executing at all, allowing in anonymous users. Printing the current_user within the method returns this:

<flask_login.AnonymousUserMixin object at 0xb67dbd4c>

Is it not supposed to reject users which return false in user.is_autheticated()? What did I do wrong?

---

I have setup FL this way:

lm = LoginManager(app)
lm.login_view = 'root'

in views.py:

@lm.user_loader
def load_user(id):
    return User.query.get(int(id))

the actual view:

@login_required
@app.route("/messages")
def messages():
    print "current user", current_user
    return "hello world"