nearly working in full (req.session breaks between callbacks)