reflect custom userProperty in session

This PR makes passport use the custom 'userProperty' as the session variable. So instead of session.user regardless of the 'userProperty' we can have it be session[userProperty].

This simple change makes it significantly easier to use passport for multi-tenanted applications.

Without this PR one can only be logged as one type of user at a time since it is always persisted to the same session variable.

Tests are also modified to reflect changes (i.e. I effectively changed all instances of session.user to session[userProperty])