Avoid `express` dependency

[brettz9]

Is this a security issue?

No.

Despite being advertised as supporting Connect as well as Express middleware, there are a number of Express dependencies which should I believe be instead avoided or at least called out or made optional. For example, res.redirect is used (and in passport-local, req.query/req.body).

I thought I'd post here to get consensus on a general approach to the problem and then fix or document accordingly.

[rwky]

Connect supports the bodyParser middleware so for passport-local we just need to specify that in the docs.

As for res.redirect good spot. It'd be trivial to adjusted our code to detect if res.redirect is a thing, if it is then use it else use the native node methods.