why there's no req.session