Oops, I just totally misread it. I thought that passport.authenticate was middleware rather than what responds to the route.