socketio and express passport app

Can someone look in my code and tell what is wrong? Im new to node js , but I'm trying to understood it and write app that will authenticate users and serve live data to dashboard. Im stuck on login procedure.

Login screen comes back after post user pass. If I will move function res.flash() it says that needs sesion. I spend two days writing this code. Please look.

var express = require('express');
var path = require('path');
var favicon = require('serve-favicon');
var logger = require('morgan');
var cookieParser = require('cookie-parser');
var bodyParser = require('body-parser');
var exphbs = require('express-handlebars');
var flash = require('connect-flash');

var index = require('./routes/index');
var users = require('./routes/users');

var app = express();

var passport = require('passport');
var signature = require('cookie-signature');
var LocalStrategy = require('passport-local').Strategy;
var mongoose = require('mongoose');
var http = require('http');
var cookie = require('cookie');

// Starting express server

app.set('port', process.env.PORT || 3000);

var server = app.listen(app.get('port'), function() {});

// Share variables to socket;
var onlineUsers = [];    var dataIO=[];

// MONGOSE DATABASE
mongoose.connect('mongodb://localhost/mydb');
var Schema = mongoose.Schema;
var db = mongoose.connection;

var UserDetail = new Schema({
username: String,
password: String
}, {
collection: 'users'
});
var users = mongoose.model('users', UserDetail);
app.use(flash());
/// PASSPORT
app.use(passport.initialize());
app.use(passport.session());
var session = require('express-session');
var store = new session.MemoryStore();
var secret = 'secret-session-key';

app.use(session({
secret : secret,
store : store,
saveUninitialized: true,
resave: true}
));

app.use(bodyParser.json());
app.use(bodyParser.urlencoded({
extended: true
}));

app.use(function (req, res, next) {
   res.locals.success_msg = req.flash('success_msg');
   res.locals.error_msg = req.flash('error_msg');
   res.locals.error = req.flash('error');
   res.locals.user = req.user || null;
   next();
});

app.post('/login',
passport.authenticate('local', {
    successRedirect: '/loginSuccess',
    failureRedirect: '/loginFailure',
})
);

passport.serializeUser(function(user, done) {
done(null, user);
});

passport.deserializeUser(function(user, done) {
done(null, user);
});

passport.use(new LocalStrategy({
    usernameField: 'username',
    passwordField: 'password'
},
function(username, password, done) {
    process.nextTick(function() {
        // auth logic
        users.findOne({
            'username': username,
        }, function(err, user) {
            if (err) {
                return done(err);
            }
            if (!user) {
                return done(null, false);
            }
            if (user.password != password) {
                return done(null, false);
            }
            return done(null, user);
        });
    });
}));

var io = require('socket.io').listen(server);
io.on('connection', function (socket) {
socket.send('hi');
socket.send('onlineUsers :'+ onlineUsers);

});
io.on('connection', function(socket) {
if (socket.handshake & socket.handshake.headers &             socket.handshake.headers.cookie) {
    var raw = cookie.parse(socket.handshake.headers.cookie)['connect.sid'];
    if (raw) {
        socket.sessionId = signature.unsign(raw.slice(2), secret);
    }
}
if (socket.sessionId) {
    store.get(socket.sessionId, function(err, session) {
       // console.log(session.passport.user.username);
        if (session) {
            if (onlineUsers.indexOf(session.passport.user.username) == -1) {
                onlineUsers.push(session.passport.user.username);
                console.log(onlineUsers);
            }
        }
    });
}
socket.on('disconnect', function() {
    console.log('disconnecting');
    if (socket.handshake & socket.handshake.headers & socket.handshake.headers.cookie) {
        var raw = cookie.parse(socket.handshake.headers.cookie)['connect.sid'];
        if (raw) {
            socket.sessionId = signature.unsign(raw.slice(2), secret);
        }
    }
    if (socket.sessionId) {
        // console.log(socket.sessionId);
        store.get(socket.sessionId, function(err, session) {
            if (session) {
                // console.log(session);
                console.log(onlineUsers);
                    onlineUsers.splice(onlineUsers.indexOf(session.passport.user.username), 1);
                console.log(onlineUsers);
            }
        });
    }
});
});





// view engine setup
app.set('views', path.join(__dirname, 'views'));

app.engine('handlebars', exphbs({defaultLayout: 'layout'}));
app.set('view engine', 'handlebars');

app.use(logger('dev'));
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({ extended: false }));
app.use(cookieParser());
app.use(express.static(path.join(__dirname, 'public')));

app.use('/', index);
app.use('/users', users);

// catch 404 and forward to error handler
app.use(function(req, res, next) {
  var err = new Error('Not Found');
  err.status = 404;
  next(err);
});

// error handler
app.use(function(err, req, res, next) {
  // set locals, only providing error in development
  res.locals.message = err.message;
  res.locals.error = req.app.get('env') === 'development' ? err : {};

  // render the error page
  res.status(err.status || 500);
  res.render('error');
});



module.exports.onlineUsers = onlineUsers;
module.exports = app;

via Zbigniew Adam Karski