you need this!  

req.session (below) is for the session with the cas server.  the access to redis is required to get at and invalidate the session for the web client, which could be handled by an entirely different server process.  Redis doesn't care about that and is super fast and stable, which is why i am using it.

anyway, if you delete this without replacing it, you''l never get ssoff to work