Strategies & Verify Callbacks

Passport is one interface repeated: a strategy collects credentials, a verify callback resolves them to a user, and done() decides the outcome. That contract is what lets you add a custom strategy.