session mongoose bug

gistfile1.js

	app.post('/login', function(req, res){

		User.findOne({email:req.body.email}, function(err, user){
			if (err) throw err;
			if (user && user.isValidPassword(req.body.password)){
				user.last_login = Date.now();
				user.save(function(err){
					if (err) throw err;
					req.session.user = user;
					// console.log(req.session.user) // THIS WORKS!
					res.redirect('/dash');
				});
			}
			else {
				req.session.messages = ["Login failed."];
				res.render('login', {
					title    : 'Login Error',
					msg      : 'Login failed.',
					referrer : ''
				});
			}
		});
		
	});
	
	
	app.get('/dash', requireSession, function(req, res){
		// show dashboard
	});
	
	
	function requireSession(req, res, next){
		if (!req.session.user){ // ALWAYS UNDEFINED
			res.render('login', {
				title    :'Login', 
				referrer : req.url,
				msg      : "Access denied. Please log in."
			});
		}
		else next();
	}