fixed a security issue

Sockets are authenticated even if the the deserialize function gives an error, or finds nothing!

As the deserialize function looks like this

```javascript
passport.deserializeUser(function(id, done) {
  User.findById(id, function(err, user) {
    done(err, user);
  });
});
```
we have to check if there is an error, or if `user` is valid.