-
loggedInUser
global variable is deleted. -
getLoggedInUserData(email)
method is added. - Authentication checking when accessing a protected page is done only using
req.isAuthenticated()
. - As the result,
getLoggedInUserData(email)
should be called whenever a protected page is accessed. This approach might be heavier for the system, but it is more secure.