add require_user middleware. ignore regenerated app.js