If no access token is sent, it ensures that req.username is set to null; furthermore, none of your hooks are called, so you can be sure that no properties that they set are present. The idea behind ...