in the end, the problem with passportjs is the constant presence of a session in req. Therefore, we must hang middleware on all requests