You could just use `req.session.user.email` instead