`user` doesn't even seem to be used in this endpoint anyways... Is it only required to make sure that the request is authenticated? If so, just checking if `req._email` exists is sufficient.