This has a whole bunch of stuff in a big if and that is followed by a tiny little

``` javascript
} else {
  res.send(401, 'Unauthorized'); // not authorized
}
```

For things like this where the check is "if things are correct, do the actual logic, otherwise short-circuit and return something", I tend to prefer to place all of the "verify things are correct" logic at the beginning and return from them if it fails.

That is, I'd prefer

``` javascript
if (sessionToken == null) {
  res.send(401, 'Unauthorized'); // not authorized
  return next();
}

var tokenData = unpack...
...
```