Improve how empty req.user is handled

[ceciliaavila]

We should:

1. add a warn if req.user is null
2. add comments in the jsdocs