We'll, req.session.uid isn't set until this point, even if a cookie-based session already exist.  Before here no user is considered logged in.