Passive authentication

Allows for passive authentication by adding `passive: true` to options. Calls the callback with `null` profile in case of passive authentication without logged user - it is up to verify function to act accordingly.