Use SQL-based storage for login credentials, via Sequelize. Use Passport for auth.
Use an interceptor to catch 401 requests