why does it open with any pass after i use the correct password once?

import express from "express";
import { dirname } from "path";
import { fileURLToPath } from "url";
const __dirname = dirname(fileURLToPath(import.meta.url));
import bodyParser from "body-parser";


const app = express();
var userAuthorised = false;

app.use(bodyParser.urlencoded({extended: true}));

function passCheck(req, res, next) {
    
    if (req.body["password"] === "ILoveProgramming"){
        userAuthorised = true;
    }
    next();
}

app.use(passCheck);

app.get("/", (req, res) => {
    res.sendFile(__dirname + "/public/index.html");
});

app.post("/check", (req, res) => {
    console.log(req.body);
    if(userAuthorised){
        res.sendFile(__dirname + "/public/secret.html");
    }
    else {
        res.redirect("/");
    }
});

app.listen(3000, () => {
    console.log("Server Running on port 3000");
});

so i have 2 html files, one with just a form(which takes in a password) and one with secrets. i wrote this js code but when i run it, it refuses every wrong password until i put the correct password once and then when i go back it takes all the incorrect passwords aswell.

where am i going wrong?