fix passport req.user, #8