Clean up req.user middleware
Use User.byExternalId(id) in ensureUserFromJWTToken