removed xtend and tokenDirect
return 401 if req.user is undefined