passport still does not seem to be writing out a session cookie