add req.session.userId back in after all