auth.js

function auth() {
	return function (req, res, next) {
		var token = headers() || query();

		if (!token) {
			return next({message: 'access token missing', status: 401});
		}

		req.mongo.accounts.findOne({accessToken: token}, function (err, account) {
			if (err) {
				return next(err);
			}

			if (!account) {
				return next({message: 'not authorized', status: 401});
			}

			req.account = account;

			next();
		});

		function headers() {
			return req.headers['x-token'] || req.headers['x-access-token'];
		}

		function query() {
			return req.query.accessToken || req.query.accesstoken;
		}
	};
}

module.exports = auth;