diff --git a/History.md b/History.md
index c094fe67..4cf8e07e 100644
--- a/History.md
+++ b/History.md
@@ -1,3 +1,8 @@
+unreleased
+==========
+
+  * Do not require `req.originalUrl`
+
 1.6.3 / 2014-07-04
 ==================
 
diff --git a/index.js b/index.js
index 9fd030bc..2aa037bb 100644
--- a/index.js
+++ b/index.js
@@ -128,7 +128,7 @@ function session(options){
     if (!storeReady) return debug('store is disconnected'), next();
 
     // pathname mismatch
-    var originalPath = parse(req.originalUrl).pathname;
+    var originalPath = parse(req.originalUrl || req.url).pathname;
     if (0 != originalPath.indexOf(cookie.path || '/')) return next();
 
     // backwards compatibility for signed cookies
@@ -136,7 +136,7 @@ function session(options){
     var secret = options.secret || req.secret;
 
     // ensure secret is available or bail
-    if (!secret) throw new Error('`secret` option required for sessions');
+    if (!secret) next(new Error('`secret` option required for sessions'));
 
     var originalHash
       , originalId;
diff --git a/package.json b/package.json
index 159911a7..cdd730db 100644
--- a/package.json
+++ b/package.json
@@ -22,7 +22,7 @@
   "devDependencies": {
     "after": "0.8.1",
     "cookie-parser": "1.3.2",
-    "istanbul": "0.2.12",
+    "istanbul": "0.2.14",
     "express": "~4.4.0",
     "mocha": "~1.20.1",
     "should": "~4.0.4",
diff --git a/test/session.js b/test/session.js
index c429a8c2..22462204 100644
--- a/test/session.js
+++ b/test/session.js
@@ -1455,8 +1455,8 @@ function cookie(res) {
 }
 
 function createServer(opts, fn) {
-  var app = express()
   var options = opts || {}
+  var respond = fn || end
 
   if (!('cookie' in options)) {
     options.cookie = { maxAge: 60 * 1000 }
@@ -1466,11 +1466,19 @@ function createServer(opts, fn) {
     options.secret = 'keyboard cat'
   }
 
-  app.set('env', 'test')
-  app.use(session(options))
-  app.use(fn || end)
+  var _session = session(options)
 
-  return http.createServer(app)
+  return http.createServer(function (req, res) {
+    _session(req, res, function (err) {
+      if (err) {
+        res.statusCode = err.status || 500
+        res.end(err.message)
+        return
+      }
+
+      respond(req, res)
+    })
+  })
 }
 
 function end(req, res) {