is routes.js really the correct place for passport related code? I think it would be cleaner to separate this into a authentication.js and require that in app.js, but still keep the actual routes ('/logout') + ('/login') here in routes.