ctx.req.user being called by a dependency
Issue will be tracked here

@jeffijoe in #57

> It appears that the `verify` callback in strategies use the req setter. E.g. https://github.com/jaredhanson/passport-http/blob/master/lib/passport-http/strategies/basic.js#L95
> 
> I checked the stack trace:
> 
> ```
> at IncomingMessage.Object.defineProperty.set [as user] (\node_modules\koa-passport\lib\framework\koa.js:37:19)
> at Object.properties.(anonymous function).set (\node_modules\koa-passport\lib\framework\request.js:113:16)
> at Object.req.login.req.logIn (\node_modules\passport\lib\http\request.js:44:18)
> at Object.<anonymous> (\node_modules\koa-passport\lib\framework\request.js:104:27)
> at BasicStrategy.strategy.success (\node_modules\passport\lib\middleware\authenticate.js:235:13)
> at verified (\node_modules\passport-http\lib\passport-http\strategies\basic.js:91:10)
> ```
> 
> So this deprecation notice is unavoidable it seems.
> 
> Should I open a new issue?

@mapmeld in rkusa/koa-passport-example#20

> With the latest update to koa-passport, I get a `koa-passport deprecated setting ctx.req.user is deprecated in favour of ctx.state.user` warning when I log in
> 
> This codebase doesn't use `ctx.req` or `ctx.state`, so my best guess is that it's coming from `koa-route` or another dependency.
