* switch express to cookieSession
* use passport authentication in queue
* return to requireAuthentication in auth