docs: only execute the passport middleware once

Before this change, the session and user context were retrieved once
per HTTP request and not once per session.