passport.js passport.initialize() middleware not in use

Follow the example to avoid the out-of-order middleware hell that express makes it so easy to enter. Straight from the docs. Note how yours does not match this exactly.

var app = express();
app.use(require('serve-static')(__dirname + '/../../public'));
app.use(require('cookie-parser')());
app.use(require('body-parser').urlencoded({ extended: true }));
app.use(require('express-session')({
  secret: 'keyboard cat',
  resave: true,
  saveUninitialized: true
}));
app.use(passport.initialize());
app.use(passport.session());

Docs

1. cookieParser
2. session
3. passport.initialize
4. passport.session
5. app.router

You

1. passport.initialize
2. passport.session
3. cookieParser
4. session
5. app.router