Remove the login callback url and just use the redirects. Causes passport to manage the user login and associate it with the session.