initial login spike with passport and mongoose