No monkeypatch

[jaredhanson]

This PR removes the monkey patching of node's http.IncomingMessage. Instead of that, it adds methods to each request as it passes through middleware, in a way that fits the patterns in other Express middleware.

In addition to that, session internals have been refactored to operate on req.session directly, rather than a pointer maintained at req._passport.session. This is part of an ongoing effort to refactor away from req._passport and clean up internals which use that.

For those same reasons, use of this._passport.instance._userProperty has been refactored to req._userProperty. This cleans up internals while also allowing the possibility of setting a custom user property per-request via middleware, rather than globally for all requests processed through the singleton Passport instance.