moved passport code from app.js to its own file