added express-session to package.json