update the comments on how passport handles serialize/deserialize. We
shouldn't need to use those methods