hmm
Changed secret cookie string, I think it didnt like spaces or something.
Changed secret cookie string again, why does this work locally?
removed sessions, I will deal with it when I have slept more.
Adding engines in package.json, did not realize that express generated apps just dont bother to include that.