send res.locals instead of res when possible

lib/cartodb/api/auth_api.js

@@ -86,7 +86,7 @@ AuthApi.prototype.authorizedByAPIKey = function(user, req, callback) {
  * @param req - standard req object. Importantly contains table and host information
  * @param callback function(err, allowed) is access allowed not?
  */
-AuthApi.prototype.authorize = function(req, res, callback) {
+AuthApi.prototype.authorize = function(req, params, callback) {
     var self = this;
     var user = req.context.user;
 
@@ -101,11 +101,11 @@ AuthApi.prototype.authorize = function(req, res, callback) {
             // if not authorized by api_key, continue
             if (!authorized)  {
                 // not authorized by api_key, check if authorized by signer
-                return self.authorizedBySigner(res.locals, this);
+                return self.authorizedBySigner(params, this);
             }
 
             // authorized by api key, login as the given username and stop
-            self.pgConnection.setDBAuth(user, res.locals, function(err) {
+            self.pgConnection.setDBAuth(user, params, function(err) {
                 callback(err, true); // authorized (or error)
             });
         },
@@ -120,7 +120,7 @@ AuthApi.prototype.authorize = function(req, res, callback) {
                 // if no signer name was given, let dbparams and
                 // PostgreSQL do the rest.
                 //
-                if ( ! res.locals.signer ) {
+                if ( ! params.signer ) {
                     return callback(null, true); // authorized so far
                 }
 
@@ -128,7 +128,7 @@ AuthApi.prototype.authorize = function(req, res, callback) {
                 return callback(null, false);
             }
 
-            self.pgConnection.setDBAuth(user, res.locals, function(err) {
+            self.pgConnection.setDBAuth(user, params, function(err) {
                 req.profiler.done('setDBAuth');
                 callback(err, true); // authorized (or error)
             });