session: convert from this.http.getSid() to req.session