I agree, res.cookie() should be used to remove as much code duplicated here as possible.