How about `req.isAuthenticated() and req.session.email` ?