add deprecation message to req.auth