anything that relies on session is checked by https://github.com/Pomax/goggles.webmaker.org/blob/newauth/lib/middleware.js#L40 (or, should be). As such, if a user is authorised, session.user should exist, unless there's a bug in webmaker-auth