That's a breaking change in v18  ```  server.auth.test() return value changed from credentials to { credentials, artifacts }.  ```  so we should do  ```js  const { credentials: session } = await this.server.auth.test('security-cookie', this.request);  ```