fixed req.user undefined