if req.user._id is undefined, we get a error 500, which should be 401
```
TypeError: Cannot read property '_id' of undefined
```
but I guess this will fixed in another ticket