changed sign-in strategy to reading the user from DB instead of using the passport object