understanding authentication in nodejs