the null check taking a reference of req.session does not take the function so destory is never called