I strongly suspect that this is not needed, and if it is, then it's a bug. However, to leave this in, use the same environment variable for both cookieParser and cookieSession so it's easy to remove the unneeded bit later