title: Express js session issue
body: <p>I have an Express app wherein sessions are troublesome.</p>
  
  <p>The code generally works, following successful login, the user should be directed to a 'dashboard' page (if no specific url has been requested).</p>
  
  <p>login.js sets req.session.user to an object of user info.</p>
  
  <p>To check if any route is authorised, I have a middleware (authuser.js) that checks req.session.user</p>
  
  <p>The problem is that this test is (apparently randomly) failing. Here is an (edited) log of the console, where you can see login.js reporting req.session.user, followed by authuser.js failing the test on req.session.user:</p>
  
  <pre><code>Login success - session: Session {
    cookie: 
     { path: '/',
       _expires: 2019-08-24T13:30:16.023Z,
       originalMaxAge: 604800000,
       httpOnly: true },
    requested_url: '/dashboard',
    __lastAccess: 1566048616023,
    user: 
     { username: 'me',
       display_name: 'Jeff',
       role: 'admin',
       groups: null,
       set_password: true,
       organisation: 'jeff',
       organisation_id: '1',
       maxDiskSpace: '2048000000',
       default_module: 'default',} }
  Login -redirecting to /dashboard
  Auth user: No req.session.user /dashboard
  POST /login 302 131.560 ms - 64
  GET /dashboard 302 1.167 ms - 56
  GET /login 200 20.086 ms - 1203
  </code></pre>
  
  <p>app.js:</p>
  
  <pre><code>var session = require('express-session');
  var FileStore = require('session-file-store')(session);
  
  var fileStoreOptions = {};
  var sess = {
    store: new FileStore(fileStoreOptions),
    secret: 'Fuzz-whib-49',
    resave: true,
    saveUninitialized: false,
    cookie: {
      maxAge: 7 * 24 * 3600 * 1000 // 7 days
    }
  }
  
  app.use(session(sess));
  </code></pre>
  
  <p>login.js:</p>
  
  <pre><code>router.post('/', function(req, res, next) {
    auth.login( req )
    .then( user =&gt; {
      req.session.user = user;
  
      var next_route = req.query.next || req.session.requested_url || '/dashboard';
      delete req.session.requested_url;
  
      res.redirect(next_route)
    })
    .catch( function( error) {
    ...
  </code></pre>
  
  <p>dashboard.js:</p>
  
  <pre><code>router.get('/', authUser, function(req, res, next) {
      console.log('Dashboard: Session id: ' + req.session.id);
      console.log('Dashboard - user: ' + req.session.user.username); 
      var mod = loadAppModule(req.session.user);
      var title = mod.title;
      res.render("dashboard", { 
        module: mod,
        user: req.session.user,
      });
  });
  </code></pre>
  
  <p>authuser.js middleware:</p>
  
  <pre><code>module.exports = function(req, res, next) {
    if(req.session.user) {
      next();
    } else {
      console.log('Auth user: No req.session.user ' + req.originalUrl)
      req.session.requested_url = req.originalUrl;
      res.redirect('/login')
    }
  }
  </code></pre>
  
  <p>logout.js</p>
  
  <pre><code>router.post('/', authUser, function(req, res, next) {
  console.log('Logout ' + req.session.user.username);
      req.session.destroy(function(){
        res.redirect('/');
      });
  });
  </code></pre>
  
  <p>What gives?</p>