auth.js

// server.js
var app = express();
var user = require('user');
var static = require('static');

app.route('/user/*', user);
app.route('/s/*', static);



// user.js
var user = express();
var middleware = require('middleware');

user.post('/user/login', middleware.checkToken, function(req, res) {
    ... login ...    
    res.cookie('token', tokens.encode(...))
});

user.post('/user/logout', middleware.checkToken, function(req, res) {
    ... logout ...
    res.cookie('token', null);
});

module.exports = user;



// middleware.js
module.expors = {
    checkToken: function(req, res, next) {
        var token = tokens.decode(req.cookies.token || req.query.token);
        
        if (!token) return res.error(403);
        
        req.user = token;
        next();
    }
};