pass in {req: req} from guards to access control functions

In my accessControl callbacks, I find it useful to check if the request came from the server or client. For example, I want to allow limited read/write from the browser, but limitless access from an API call given they've authenticated. The way I've been doing it is passing  `req` along with `session` (which is currently being passed) to the callbacks. Then I can just put some dummy flag on req in server routes, like `req._isServer = true`. I can't do this on `req.session` because that's not always available (eg, APIs call from a non-browser caller).