if req.session.user is undefined, you're gonna get an exception thrown