[feature] passportJS - sessions by apiKey, not username - easier to invalidate