Remove user information from session, when the login operation completes, user will be assigned to req.user