-
loggedInUserglobal variable is deleted. -
getLoggedInUserData(email)method is added. - Authentication checking when accessing a protected page is done only using
req.isAuthenticated(). - As the result,
getLoggedInUserData(email)should be called whenever a protected page is accessed. This approach might be heavier for the system, but it is more secure.