handle errors with boom.  grab user credentials from request.auth object.