Indeed, this is intentional. The logic is hidden within your forest-express-mongoose agent.
As I answered in the last topic you should have the request.user automatically setted by the authentication middleware (which avoid doing some fancy stuff).
The question is Do you have the ensureAuthenticated middleware mounted on your project?
Could you share your project name ?
How did you integrate forest-express-mongoose within your app?
We don’t use express as server library but we are using koa, and their middleware are not compatible, hence the issue with authorization header parsing.
I managed to fix this by an simple ctx.req.headers assignment.
Our new agent Node.js is natively compatible with Koa.
It might be the right path for you in the future as the developer experience is highly improved and it comes with new features.