bumped express-session to version 1.6.x