I'd handle this situation with a re-useable Html Dialog step which is called first after every public start link (Start Request).
Within this dialog you can either show the login mask. Or directly close it again as the user is already logged in. See my sample screenshots: ![alt text][1]![alt text][2]
I do not like the 'onlyWfUser' approach because it is not re-usable. It would be possible to use an Exception Start to catch the error and let the user log in on a Html Dialog. But I don't see a way to remember the start link which was used by the user. So you it's difficult to redirect the user to the correct page after you showed a login page.
[1]: http://answers.axonivy.com/upfiles/mainProcess.PNG
[2]: http://answers.axonivy.com/upfiles/loginLogic_sUYgVyW.PNG