removed session middleware and local authentication strategy