got rid of passport and now use JWT for auth