Pass req to serialize/deserialize callbacks

Passing the `req` object allows for greater flexibility when serializing/deserializing users. This comes in really handy when the action is altered based on the request.

For example, in my setup, depending on the domain in which the request comes through, it uses a different database configuration. Without the `req` object, I have no way of knowing what domain it is.

It should all be backwards compatible with existing solutions. Let me know otherwise.

Thanks for all of your work on passport!