Corrected misreading of user from session, and changed authorization failure middleware to kick an error down the stack.

Signed-off-by: Brian Langenfeld <blangenfeld@gmail.com>