Remove res.renderSubApp
Apply requireLogin to user.update