Expense approval skips the approver check
Your task
Review this Express route handler for approving an expense report. req.user is set by the session middleware when someone is signed in. Each expense records who submitted it in submittedBy, each user record has a managerId, and only a submitter's manager should approve their expenses. What do you flag?