sign in now uses Passport-local