it's a little confusing, but basic auth sets req.user.

Now that I think about it, I'll need some changes to better authenticate tags added by an authorised app.