Moved req.user.user to req.user and created req.auth