req.session.user = user;