add user info to response.locals