code: async function protect (ctx, next) {
  	if (ctx.isAuthenticated()) {
  		await next();
  	} else {
  		await passport.authenticate('bearer', {
  			session: false
  		}, async function (err, user) {
  			// console.log(err, user);
  			/* istanbul ignore if */
  			if (err) {
  				throw err;
  			}
  			if (user === false) {
  				ctx.body = null;
  				ctx.status = 401;
  			} else {
  				ctx.state.user = user;
  				await next();
  			}
  		})(ctx);
  	}
  }
docs: Makes a route only accessible if user is logged in
  and appends model to ctx.state
  @param {KoaContext} ctx
  @param {KoaNext} next
  @return {Object} {status:401, body: null}