Request object now mutable for purpose of setting req.is_authenticated