I still don't think we need to show actual code here, just say with the route for `/user/:userid` is added, and that it sets `req.session.username` if a user lookup is performed on it, with a 404 if the user was not found