GPII-17: Use session and passport middleware at routes rather than globally