Update index.js

For me, passport does not rename the user property when it actually stores the session, only when it injects it into to the incoming request object.