Store authenticated user in req.user