use bodyParser.urlencoded() instead of bodyParser()
use express-session, fix tests