-- change req.session.user with req.user after passport authentication
implementation