Corrected problem where req.locals wasn't always defined.  Wired session list by user into getUserToken middleware