Authentication now sets the account making the request at req.account