use nconf instead of process.env on setupPassport