only use passport.authenticate if a strategy url is defined