stopped using passport, just set my owown session variable on the request object after you logged in ok