don't use app.locals. You can use res.locals, which keeps the data tied to specific request/response pairs, but app.locals is app-wide and shared by every single connection