Middleware: add check if request has user attribute

e.g. WSGIRequest doesn’t have a user, see issue #7