Removing legacy code.
Adding in protection against duplicate calls to getUser().
Refactoring our middleware to use express routers.

This lets us properly use CSRF.