move passport to peerDependencies; fix specs by allowing newer vows