Add note about using express app session middleware