removing the setting of req.user in middleware