Suggested changes: read extended description

I've proposed the following changes:
1. pack.register is asynchronous, you should put all following methods inside it's callback.
2. I've separated the authentication and authorisation as I suggested. This change doesn't affect any of your API routes, you no longer would need to call retrieve user in authStoreByName, as you have the user object from request.auth.credentials then.