fix req.session.cookies -> req.sessionCookies