check req.user before use it