create sessionAuth policy, fix deserialization issue

- resolves #1
  - set username if missing, but email is present
- resolves #2
  - refactored passport service
0.10.8