Check if user has already upgraded their legacy account

We don't want to allow the user to upgrade their legacy account more
than once since it would result in duplicate entries in the permissions
collection. If they try to login with a legacy account then an error
will be shown telling them to login with their new site-wide account.
Remove User lookup from deserializeUser

It is no longer possible to login with a legacy user account, you now
must use a popit site-wide account.
Put passport related things into separate module

The passport configuration is used in several places, but was being
configured in the auth module, which worked, but only by accident. This
forces all places which require passport to use this module, which will
ensure it's configured correctly.