in the

signIn

function, you have to wait for

createSession

to return before doing

res.json(u)