added allowedPaths to connect.ensureLoggedIn to specify certain paths which you can except from authentication. mainly for assets after using app.all("*" ...)