/auth/callback drops on if (!req.session[key])