refactor server-config to turn off passport sessions. e.g. passport.authenticate({session:false})
we don't use passport sessions because we're using our own authentication using facebook tokens