using a variable global to the session worries me because I can see cases where a test might run tests in parallel and defeat the flag. I am thinking maybe it would be better to set flags on the req/resp objects themselves instead of the session object.