Remove session set of user

Once the passport user is found, request.user is the deserialized user, which was overriding the serialized user set during _logIn