User session vars are only updated when authenticate.auth is called. To avoid session updates, call authenticate.authIgnoreSession for route middleware.