NodeJS + MongoDB api/user authentication and access control