use passport-http-bearer for authentication