Doesn't get session take in the req and res and call db, to get the session and check if jwt in session is valid?