[yxshee]

Fixes #521.

When one store is passed to two session() middlewares, every request uses the options of the middleware registered last: its genid, cookie options and trust proxy setting. This also applies on req.session.regenerate().

const store = new session.MemoryStore()
app.use('/a', session({ name: 'a.sid', secret, store, genid: () => 'AAA-' + uid() }))
app.use('/b', session({ name: 'b.sid', secret, store, genid: () => 'BBB-' + uid() }))
// GET /a on master -> Set-Cookie: a.sid=s%3ABBB-...

Root cause: session() assigns its generator to store.generate, so the last middleware to be created overwrites it for every middleware sharing that store. Store.prototype.regenerate calls this.generate(req) too.

Fix: each middleware keeps its own generateSession. It records that function on the request in a non-enumerable property, next to req.sessionStore. store.generate(req) then calls the generator recorded on the request, and falls back to the last-created one as before. So a single-middleware app behaves the same, and so does code that calls store.generate directly. Stores that inherit Store.prototype.regenerate get the right generator with no change.

Tests: two cases under genid option, "when the store is shared". One checks the initial id and cookie, the other checks regenerate(). Both fail on master:

AssertionError: should set cookie apple.sid to s%3Aapple.D8Y...
Error: expected 'apple' response body, got 'banana'

With the fix: npm test 175 passing, npm run lint clean. A HISTORY.md entry is included.