checking login based on req.user