use express-session and mongoose to store sessions