Most of this function can be replaced by using the new `auth.protect()` middleware function.  (`auth.populateUser()` is gone now).  If there is a logged in user, `auth.protect()` will put the currently logged in user into `response.locals.user` so you could call `renderHistory(request, response, response.locals.user)`.