Auth with Passport. Username attr added.
Fix session.canAdminUser using req.user.