Removed session regeneration - express not vulnerable to fixation I think