Ok, I don't think this sign in flow is quite what you want. It works for the extension, but breaks the normal flow for users with the extension.

Instead of having the new route `/extensionauth` at all the url selected here should probably be the same url used on the landing.ejs page: `https://accounts.google.com/o/oauth2/auth?scope=profile ...`  Look [here](https://github.com/devm33/sendmail/blob/master/lib/auth.js#L21) for how it's constructed. 

And in fact maybe could just be an `<a target="_blank" href=" ...` around the button though that might make the construction messier -- up to you. A nice to have would be a dry way to do it, but I suspect it will be difficult to not have some code repeated between extension and server since they have to do some of the same things from different places. Maybe just a smart build process -- anyways offtopic.

Then when putting together that url add a flag to the callback uri that indicates it came from the chrome extension. Then in auth.authorize if this flag is present is loads the main view with different behavior/content as needed and in such a way that the chrome extension knows to scrape the data and react. The chrome extension needs to only react when this flag/div/etc is present because otherwise its a normal sign in flow.

I think that should achieve what you're looking to do and I don't think any new endpoints are needed. But of course I could be way off base here, so let me know what you think =)