replaced ensureAuth by parse current user session no need to use req.session