pass in {req: req} from guards to access control functions

Allows context without using session