Use req.user to check auth instead of req.is_auth

app/routing/middleware/auth/APIRoute.middleware.js

@@ -7,9 +7,10 @@ class APIRouteMiddleware extends Middleware {
 
     async test(req, res, next, { allow_token = true, allow_user = true }) {
         // First, check if there is a user in the session.
-        if ( allow_user && req.is_auth ) {
+        if ( allow_user && req.user ) {
             return next()
         } else if ( allow_token ) {
+            if ( !req.oauth ) req.oauth = {}
             return req.app.oauth2.authorise()(req, res, async e => {
                 if ( e ) return next(e)
                 // Look up the OAuth2 client an inject it into the route