remove use of passport session