does this fix a bug?  if not why set it?  the code checks above for req.session===undefined