req.user is the logged in user, not the profile we are viewing