don't assume there is a req.user in the debug statement. fixes #21

Assuming there is a `req.user` is throwing an error when a user is not authenticated. I've added a simple work-around for this, to get either the `req.user` or `{}` if that does not exist, and make the debug check against that. Fixes #21