add middleware that requires res.user
update example config