diff --git a/src/routes/accesscontrol.js b/src/routes/accesscontrol.js
index 2eb4c10c4..fabfce3ae 100644
--- a/src/routes/accesscontrol.js
+++ b/src/routes/accesscontrol.js
@@ -109,7 +109,7 @@ function authorize(requiredRole) {
     assert.strictEqual(typeof requiredRole, 'string');
 
     return function (req, res, next) {
-        assert.strictEqual(req.user, 'object');
+        assert.strictEqual(typeof req.user, 'object');
 
         var error = accesscontrol.hasRole(req.user, requiredRole);
         if (error) return next(new HttpError(403, error.message));