acl/middleware: support `req.user.id` for userId

[nemtsov]

It's fairly common for express apps to have the logged-in user in req.user. This is shown in the express docs as well as in the popular Passport module (which exposes the user as req.user).

Thus, this change will make it easier to integrate acl with Passport and with non-browser-facing services (APIs) that don't use sessions (and do oauth instead, for example).

[muka]

:+1: me too

[nemtsov]

@manast is this something you're interested in including into the lib?

[manast]

sorry for the late merge

[nemtsov]

Awesome. Thanks.