Support ctx.state to pass user
I believe that best practice for koa v2 would be to store the authenticated user in `ctx.state`, rather than `ctx.request`.

Documentation for koa v2 indicates that `ctx.state` is "the recommended namespace for passing information through middleware ..."
https://github.com/koajs/koa/blob/v2.x/docs/api/context.md#ctxstate
