remove check req.user because it's not necessary