node.js user login manager - you shall not pass!