updated expressSession initialization to avoid deprecated options;
added get for 'Profile', that should be accessible only to logged in users;
user serialization no longer works (need to fix this asap)