a req.session is required!