I see this accesses `req.session.claim`, and can return null if not found. So `null.toLowerCase()` would error.