I agree. We mostly wanted to keep the change compact, and bringing in Express just for the authentication seemed excess. But if you want to pull something like this in anyhow, then it's better, of course :)