Using req.user from the passport token