Don't fail if `req.user` is not set