[oauth] Ensure req.basemap is set by auth middleware

Previously the auth middleware could run successfully and leave `req.basemap` unset. At each instance `next()` is called (except when called to pass errors) req.basemap is ensured to be set.

cc @edenh