because req.session was not created by anything