this needs to be req.session.user.username?