Pause request stream during (potentially async) deserialiseUser call

Because the `deserializeUser` is treated as connect middleware and may be followed by other middleware that is listening for request events, the request stream events should be buffered [until all middleware is called](https://gist.github.com/mikedeboer/3047099).  Without pausing the request, middleware that pipes the incoming request (e.g. proxy middleware) may miss the 'end' event (and eventaually the socket will hang up).