Don't destroy sessions, that causes code relying on req.session to bomb. Regenerate sessions instead. This gives you a new, empty session.