title: req.session.destroy has no effect
body: <p>I have a NextJS client running on localhost:3001 and a Express/MongoDB server running on localhost:3000.</p>
  <p>For authentication I'm using <code>express-session</code> with <code>connect-mongo</code> like so:</p>
  <pre class="lang-js prettyprint-override"><code>app.use(session({
      secret: 'jordan-peterson-is-a-fraud',
      resave: false,
      saveUninitialized: false,
      unset: 'destroy',
      cookie: {
          httpOnly: false
      },
      store: new MongoStore({ mongooseConnection: mongoose.connection })
  }));
  </code></pre>
  <p>On login I set <code>req.session.user = userID</code>, which seems to work fine: it registers a new session record in the sessions table in my database, and sends a set-cookie header with the value <code>connect.sid=&lt;encrypted-session-ID&gt;</code> to the client which gets stored in a session cookie.</p>
  <p>So far, so good.</p>
  <p>But on logout it seems that calling <code>req.session.destroy()</code> has no effect whatsoever. The client sends a POST with credentials to <code>/logout</code> on the server:</p>
  <pre class="lang-js prettyprint-override"><code>fetch('http://localhost:3000/logout', {
      method: 'post',
      headers: {
          'Accept': 'application/json',
          'Content-Type': 'application/json'
      },
      mode: 'cors',
      credentials: 'include'
  })
  </code></pre>
  <p>And the server does seem to receive a correct <code>req</code> object that includes:</p>
  <pre><code>{
      ...
      sessionID: '&lt;encrypted-session-ID&gt;',
      session: Session {
        cookie: {
          path: '/',
          _expires: null,
          originalMaxAge: null,
          httpOnly: false
        }
      }
      ...
  }
  </code></pre>
  <p>The console also prints <code>[Function: destroy]</code> when I log <code>req.session.destroy</code>. But nothing happens when I call it. The database is unchanged - with the session record still there from the login.</p>
  <pre class="lang-js prettyprint-override"><code>router.all('/logout', async function(req, res){
      if (req.session) {
          req.session.destroy();
          return res.end();
      }
  }
  </code></pre>
  <p>Anyone know what I'm doing wrong here?</p>