req.user is populated