add comments to explain the workaround used for passport.authenticate()