don't try to stash user in session, can take too long to return from
mongo. also, stash path in locals.
don't check for user, check for user_id, in authentication check for
admin routes
don't bother stashing user in session object
user locals.user_id and locals.path to customize the toolbar