Fix order of arguments in user auth middleware

req and res are switched in the order of arguments, causing res.send to error