change to passport and mongoose