express + passport + session / req.session