fixed undefined user variable in passport authentication