If used, session id is now: req.session