Are you calling the session verify middleware in your route?