The user is injected in every request, not just when the user is authenticating. [restpack-authentication-web](https://github.com/RestPack/restpack-authentication-web) has responsibility for authenticating users and setting cookies on the domain. restpack-web is responsible for injecting useful context into the ```env```, including the current user if there is one.