You need to secure this route with a check for `req.session.user` and early return with an error if it doesn't exist.

`401 UNAUTHORIZED` is probably the appropriate response here:

```
return res.send(401, new Error("You must be logged in to submit a resource");