separated code. using passport.js for API authentication