if (!req.session || !req.session.user) {
      return res.send(401,JSON.stringify({ok:false, message: "You must be logged in to use this function"}));
    }