Fix for #360

req.user was used before assigning to it in fetchUserFromSession.
typo
Merge remote branch 'ashtuchkin/express3' into express3