User authentication using Passport
Given req.user is set at the server then, unless your server is compromised, you can ignore the 1%. 

Relying on server-side user data is the correct approach - never trust the client.