Remove session set of user

The deserialized user should never go in the session, otherwise it defeats the purpose of serialization/deserialization feature.

Once the passport user is found, request.user is the deserialized user, which was overriding the serialized user set during _logIn