basically remove all use of req.user (provided by passport) and depend
entirely on req.session.userId. Added comment as to why (read in
commit if you're curious)