Trace path of HTTP GET request through Express middleware in Node

I'm trying to debug my application and in doing so I realized I don't fully understand how an HTTP GET request finds its way down to the route. In other words, when we configure middleware like this:

app.configure(function(){
  // options
  app.set('port', process.env.PORT || 3000);
  app.set('views', __dirname + '/views');
  app.set('view engine', 'jade');

  // middleware
  app.use(express.favicon());
  app.use(express.logger('dev'));

  app.use(express.cookieParser('your secret here'));
  app.use(express.bodyParser());
  app.use(express.methodOverride());
  app.use(express.session());
  app.use(passport.initialize());
  app.use(passport.session());
  app.use(app.router);
  app.use(require('less-middleware')({ src: __dirname + '/public' }));
  app.use(express.static(path.join(__dirname, 'public')));
});

every HTTP request of any kind is fed in stages through the middleware, right?

The problem I'm having is that somewhere in my middleware, the users collection in my database is being queried and req.user is being populated with the incorrect user document, and I'm having trouble figuring out where that could possibly be happening. I know my middleware is the culprit but my debugging abilities have begun to fail me at this point. Any help would be greatly appreciated.

EDIT: Here is my passport setup:

passport.use(new LocalStrategy(function( username, password, done ) {  
  models.User.authenticate( username, password, function( err, user) {
    // reports CORRECT user
    console.log('\nmodels.User.authenticate callback');
    console.log('--username is ' + user.username);
    console.log(util.inspect(user));

    // return done( err, user );
    return done( err, user);
  });
}));

passport.serializeUser(function( user, done ) {
  // reports CORRECT user
  console.log('\npassport.serializeUser');
  console.log('--username is ' + user.username);
  console.log('--user._id is ' + user._id);
  console.log(util.inspect(user));
  done(null, user._id);
});

passport.deserializeUser(function(id, done) {
  // reports CORRECT user id
  console.log('\npassport.deserializeUser()');
  console.log('user._id is ' + id);
  models.User.findOne( id, function (err, user) {

    done(err, user);
  });
});

It appears that serializeUser and deserializeUser work as expected. They both report proper credentials when logged.