app.post('/login', (req, res) => {
    User.findOne({
        username: req.body.username,
        password: req.body.password
    }).then(record => {
        if (record) {
            req.session.loggedIn = true;
            req.session.username = record.username;

            res.redirect('/secret-page');
        } else {
            res.render('login-page', {
                error: 'wrong username or password';
            });
        }
    });
});

app.get('/secret-page', (req, res) => {
    if (req.session.loggedIn) {
        res.render('secret-page');
    } else {
        res.render('no-access');
    }
});

app.get('/logout', (req, res) => {
    res.session.destroy();
});