added POST '/authenticate', which fails at the JSON.decode line