switch back to npm passport now that 106 is fixed