req.user isn't set yet, use user

req.user isn't yet set because the user isn't logged
in.  This is a copy & paste error from the oauth authentication
flow.

use user instead, and make sure execution stops if the user is
being saved.