brought relevant changes to master from test, and took out req.session.passport bug in routes/user.js