Typo: req.user -> req.currentUser