I would lean toward req.session.regenerate, but it depends on what you are trying to do. If you just do req.session.auth = user, you save auth for the session. However, if you use regenerate, you will actually clear the entire session, and then save auth.
, . , , , .