Move the session specific setup to service.js

Since the passport policy gets called almost on every request we should move ```serializeUser``` and ```deserializeUser``` out of the middleware/policy function.