fix req.user