use passport as middleware