move passport related middleware out of routes