Fixed password  middleware relying on req.session