more support for req.session.userId
Merge branch '0.5' of github.com:lefnire/derby-auth into 0.5