Replaced deprecated req.session.loggedIn with req.session.user