fixes

Hey Waine - the key difference is what's going on between passport.authenticate('local') which actually sets up the session and ensureAuthenticated, a small helper function to make sure that the previous authentication was correct.

This version should work.