Fixing a bug when @req.session is undefined

sometimes @req.session is undefined, so checking @req.session.a throws.