Fix for #360

req.user was used before assigning to it in fetchUserFromSession.