Provide the user (if any) in response.locals.user