diff --git a/api/policies/passport.js b/api/policies/passport.js
new file mode 100644
index 0000000..fb86b6a
--- /dev/null
+++ b/api/policies/passport.js
@@ -0,0 +1,29 @@
+/**
+ * Passport Middleware
+ *
+ * Policy for Sails that initializes Passport.js and as well as its built-in
+ * session support.
+ *
+ * For more information on the Passport.js middleware, check out:
+ * http://passportjs.org/guide/configure/
+ */
+
+const http = require('http')
+
+const methods = ['login', 'logout', 'isAuthenticated', 'isUnauthenticated']
+
+module.exports = async function (req, res, next) {
+  const passport = (await sails.helpers.passport()).getPassport()
+  passport.initialize()(req, res, function () {
+    passport.session()(req, res, function () {
+      if (req.isSocket) {
+        _.each(methods, function (method) {
+          req[method] = http.IncomingMessage.prototype[method].bind(req)
+        })
+      }
+
+      req.locals.user = req.user
+      next()
+    })
+  })
+}
diff --git a/config/policies.js b/config/policies.js
index 5368665..ba50604 100644
--- a/config/policies.js
+++ b/config/policies.js
@@ -18,15 +18,7 @@ module.exports.policies = {
   ***************************************************************************/
 
   '*': [
-    'basicAuth',
-    'passport',
-    'sessionAuth',
-    'ModelPolicy',
-    'AuditPolicy',
-    'OwnerPolicy',
-    'PermissionPolicy',
-    'RolePolicy',
-    'CriteriaPolicy'
+    'passport'
   ],
 
   AuthController: {
diff --git a/config/protocols.js b/config/protocols.js
index 6542f73..e24d0aa 100644
--- a/config/protocols.js
+++ b/config/protocols.js
@@ -2,7 +2,7 @@
 const crypto = require('crypto')
 const base64URL = require('base64url')
 
-module.exports = {
+module.exports.protocols = {
   local: {
     /**
      * Validate a login request
@@ -31,7 +31,7 @@ module.exports = {
           user: user.id
         })
         if (passport) {
-          const res = await passport.validatePassword(password)
+          const res = await Passport.validatePassword(password, passport)
           if (!res) throw new Error('incorrect password')
           return next(null, user, passport)
         }