Pause request stream during (potentially async) deserialiseUser call

Because the deserializeUser is treated as connect middleware and may be followed by other middleware that is listening for request events, the request stream events should be buffered until all middleware is called (see https://gist.github.com/mikedeboer/3047099).  Without pausing the request, middleware that pipes the incoming request (e.g. proxy middleware) may miss the 'end' event (and eventaually the socket will hang up).