Loose req.session when trying to get more FB privileges via everyauth

I've been doing user authentication with everyauth and Facebook and all works well. Now, I want to integrate an ability to post to Facebook. Since my app asks only for email scope when users first login, I'll need to get a larger FB scope, and am trying to follow the FB guidelines and only ask for this additional scope when I need it.

I added the following code to my everyauth configuration as per the docs:

everyauth
.facebook
    .appId(conf.fb.appId)
    .appSecret(conf.fb.appSecret)
    //TODO add custom redirect for when authentication is not approved
    .scope(function (req, res) {
        console.log('Setting FB scope');
        console.log('Session: ' + util.inspect(req.session));
        var session = req.session;
        switch (session.userPhase) {
            case 'share-media':
                return 'email,user_status';
            default:
                return 'email';
        }
     })

All is well when an unauthenticated user logs into the application. The problem is that when I want to "up the ante" on FB scope, which I do by setting req.session.userPhase to 'share-media', and then present a link to /auth/facebook to confirm they want to allow posting to FB. When this happens, I get an error that req.session is undefined from the above code (all of req is undefined).

I assume this is since a previously logged-in user is essentially re-authenticating, but isn't that how I would get more scope from Facebook? Am I going about this the wrong way?

Thanks!!!