This passport documentation page shows, in the "Custom Callback" section at the bottom, that, for the way you are using passport in your main snippet, the request method should be a 'get', not a 'post'. I copy here the code snippet from that page:
app.get('/login', function(req, res, next) {
passport.authenticate('local', function(err, user, info) {
if (err) { return next(err); }
if (!user) { return res.redirect('/login'); }
req.logIn(user, function(err) {
if (err) { return next(err); }
return res.redirect('/users/' + user.username);
});
})(req, res, next);
});
That page has other examples of how passport can be used, including the "local" variant that you attempted.