use cookieSessions instead of express MemoryStore