using passport to access users Mongo id -- fixed listing create route