Session's are disabled by default unless req.login()