replacing passport.js with lockit