In cases where there is no "time" property set on the session object, this expression evaluates to `NaN`, which is then used in the comparison below that.  That's a bit awkward -- generally I think it's good to avoid using NaN in comparisons.

You might set your duration variable to an explicit default value:
`var duration = req.session.time ? (new Date()).getTime() - req.session.time : 0;`

And if so, you could also factor that out to a little helper function. That might help with creating a unit test, to have a helper that you could trivially override to supply a fixed value.