Don't set req.user