simple login flow using passport.js