meh session.passport needs user too