use req.user not res.user !