0.1.32: always refresh users from the database rather than storing the entire user object in the session. This allows users to gain or lose privileges or lose their accounts entirely on the fly, which is important for security reasons. Also set a ._mongodb flag on user objects that came from MongoDB. A new afterDeserializeUser callback is available.