add req.session.userId = null