Can this be `req.session.username` instead then?