I update session using update(). I then try redirect my user to a protected route (which update sets flag to true). If i save my code and refresh, it works and I can access the routes. Its like it needs to issue a new token or something