Protect routes in express using passport.js, multiple user authentication