from https://github.com/ptdecker/passport-local , but with session.regenerate() etc.