     # affects all app... requests after this one
     # the only accessable thing before logging in is the login form
     app.use "/api", (req, res, next) ->
-      if devUser and !req.session.uid?
-        req.session.uid = devUser
       if !req.session.uid?
         res.location(config.session.login_redirect)
         next new Error "Please login before accesing the App"

    )

    app.use "/api/login", (req, res) ->
      # dummy auth sets everyone to 123 and accepts only 123
      userExists(req.body.id).then((exists) ->
        if !exists
          console.log "user does not exists #{req.body.id}"
          res.status(401).end()
          return
        req.session.uid = req.body.id


session = require 'express-session'

module.exports = (userLogin) ->
  (app, config) ->
    app.use session(
      secret: config.session.secret
