Use concrete resource name instead of generic "resource"

src/routes/users.js

@@ -33,7 +33,7 @@ async function load(req, res, next) {
     const [error, result] = await safe(users.get(req.params.userId));
     if (error) return next(BoxError.toHttpError(error));
     if (!result) return next(new HttpError(404, 'User not found'));
-    req.resource = result;
+    req.resource = result; // this is not req.user because req.user is already the authenticated user
 
     next();
 }