code: function resp(response) {
          if (!request.session) {
            debug("no session")
            return response
          }
  
          if (utils.shouldSetCookie(request) === false) {
            return response
          }
  
          // only send secure cookies via https
          if (request.session.cookie.secure && !utils.issecure(request, trustProxy)) {
            debug("not secured")
            return response
          }
          // touch session
          request.session.touch()
          // set cookie
          utils.setcookie(response, name, request.sessionID, secrets[0], request.session.cookie.data)
  
          if (utils.shouldDestroy(request)) {
            debug("destroying")
            store.destroy(request.sessionID, function ondestroy(err) {
              if (err) throw err
              debug("destroyed")
            })
          } else if (utils.shouldSave(request)) {
            request.session.save(function onsave(err) {
              if (err) throw err
            })
          } else if (utils.storeImplementsTouch && utils.shouldTouch(request)) {
            // store implements touch method
            debug("touching")
            store.touch(request.sessionID, request.session, function ontouch(err) {
              if (err) throw err
              debug("touched")
            })
          }
  
          return response
        }
docs: ///////// this is the 'return' response flow back