node, express, mongoose - with user and authorization