code: function login (req, user) {
    setSessionAmr(req.session, req.provider.amr)
  
    // only update the OP Browser State if the user is not already logged in
    if (req.session.user !== user._id) {
      req.session.user = user._id
      req.session.opbs = crypto.randomBytes(256).toString('hex')
    }
  }
docs: Login