access user data through req.user