I think the user was not authenticated..

Maybe the examples in the documentation needs an update too:

http://passportjs.org/docs/authorize (last code block)

Yeah it's a little ridiculous that this isn't documented, given that checking it is pretty much the entire ultimate goal of this library...

The consequence of this little mistake is a zillion tutorials that stop at the page authorization part, or goofie strategies like checking if random session fields are undefined.

It's sort of beyond me how Passport has gone on for so long with zero mention of this function on the page, in the readme, or in any other docs, given how important it is.