update express-cookie-blacklist version
use undefsafe
use oldSessionUser rather than req.session.user