move passport logic to PassportAuth.js