Alright, I found the solution. Using req.session.authenticate doesn't work. I should use req.auth.login(user) instead.