save all attributes on req.user