fixed user to req.user