title: Session login with Passport (Node.js/Express)
body: <p>How to manage session logins with Passport (Express)? By session logins I mean: an authenticated user should not have to resend credentials at each request.</p>
  
  <p>In the following example, <code>myStrategy.authenticate()</code> keeps being called even if the user previously authenticated.</p>
  
  <pre><code>var express = require( "express" );
  var session = require( "express-session" );
  var passport = require( "passport" );
  var app = express();
  
  var myStrategy = function(){ this.name = "mystrategy"; };
  myStrategy.prototype.authenticate = function( req ) {
    console.log( "called" );
    this.success( "user" );
  };
  
  passport.use( new myStrategy() );
  passport.serializeUser( function( id, cb ){ cb( null, id ); });
  passport.deserializeUser( function( id, cb ){ cb( null, id ); });
  
  app
    .use( session({ secret: "hello", resave: true, saveUninitialized: true }) )
    .use( passport.initialize() )
    .use( passport.session() )
    .get( "/", passport.authenticate( "mystrategy" ), function( req, res ) {
      res.send( "OK" );
    })
    .listen( 80 );
  </code></pre>
  
  <p>It seems <code>passport.session()</code> retrieves <code>req.user</code> from <code>req.session.passport.user</code>, but <code>passport.authenticate()</code> fires even when <code>req.user</code> is defined, which defeats the whole point.</p>