Got schoolDays.html client to be able to post after authenticating with token/username/password. Also throws 401 if not correct combination. However, I think that stuff needs to be pulled out into a passport strategy and the strategy chosen based on whether or not the request has a token in the body.