well. there are two

updateAccessTokenPayload

functions. One that accepts a sessionHandle (which can be called without having to verify a session first) and the other accepts just the payload. The second one needs to be done like

req.session.updateAccessTokenPayload(newPayload)

so it's applied on the "current" session.