Username/password auth for express apps with Mongoose-backed user models