fixed req.session.user info bug