use res.locals user object