Pin passport deps in package.json