pass in {req: req} from guards to access control functions, so they
can determine for example if the request came from the client or server