Demo webapp protected by a CAS client in Node.js