in the passport [configure authentication] documentation, it has a rather scary-looking function that uses the mysterious function \"done.\'
passport.use(new         
        
passport's done() wants you to pass in an error (or null) for the first param and a user object as the 2nd param.
express's next() wants an error in the first param or to be called with no parameter at all if there wasn't an error. you could also pass the name of a route to redirect control to in the first parameter but this isn't very common