Authentication of express/node.js application using local strategy - NON-https.