middleware: write it better, don't bork if request has no user