Remove need to call passport.initialize()

[jaredhanson]

This PR continues the work started in #848, completing the refactor away from using req._passport.

Following the patterns of other middleware, the HTTP request is now extended when it passes through authenticate() middleware, rather than initialize(). This removes the need to use passport.initialize() entirely, which simplifies the app-level middleware stack. It should also make it easier to adapt Passport to non-Express web frameworks.

[RealDrewKlayman]

This shouldn't really be marked as a patch.
It has breaking changes and will break anybody that has it listed in the package.json with ^0.5.0 and show this error:
passport.initialize() middleware not in use

[jaredhanson]

Can you provide details? You shouldn't be getting that error, so there must be some other unexpected condition occurring. I'm confident that there should be no breaking changes here.

[jaredhanson]

To add to my rationale: The error string you mention, "passport.initialize() middleware not in use", is only present in the passport package itself, prior to 0.5.1. If you upgrade to the latest release, the error string has been removed (since passport.initialize() is no longer required). If you are still seeing this error message, it suggests that you haven't updated to 0.5.1. Perhaps a package-lock.json is pinning you to a prior release?

[jaredhanson]

@RealDrewKlayman Can you provide a list of the strategies you use in your application? As discussed in #877, passport-azure-ad pulls in an older version of passport, which can trigger this issue. I'm working on a fix, but I'd like to assemble a list of strategies that require a compatibility layer. Thanks!

[sonofole]

I am working on the same project as @RealDrewKlayman. Our package.json had passport: "^0.5.0" (which resulted in passport@1.5.1 being used according to npm list passport on the server), as well as passport-azure-ad@4.3.1, which has a dependency of passport@0.4.1.

It's possible that some interaction between these caused the problem, but the problem was resolved by changing our package.json to passport: "0.5.0", which prevented passport@0.5.1 from being installed on the server.

The project also includes passport-headerapikey@1.2.2 and passport-local@1.0.0.

[sonofole]

@jaredhanson I just read through #877 and that does appear to be the same problem we're experiencing

[jaredhanson]

Thanks for confirming @sonofole . I've published passport@0.5.2 which should resolve the issue. Could you upgrade and confirm that works?

[sonofole]

@jaredhanson Yes it appears to be working with 0.5.2, thanks for the quick fix!