added DO_NOT_SAVE flag onto the request, so we can omit session saving without nulling req.session