After signup, req.session.refcodes was being modified and deleted -- this should not happen. Fixed.