make sure `ctx.passport` isn't undefined before using `in` operator