The logged in user is now exposed as req.user