code: function(doRecentCheck, req, res, next) {
    var app = req.app;
    var config = app.loadConfig('auth');
  
    var failed = !req.isAuthenticated();
    if (!failed && doRecentCheck && !req.session.impersonated) {
      //skip recent check if login is impersonated
      //note: loginTime maybe a string since sessions are serialized as json
      failed = !req.session.loginTime ||
        !(new Date() - new Date(req.session.loginTime) <= config.recentLoginTimeoutSeconds*1000);
      if (failed) { //force reauthentication (e.g. for facebook login for example)
        req.session.reauthenticate  = true;
      }
    }
  
    // if user is not authenticated, redirect to login
    if (failed) {
      // remember original requested url
      req.session.returnTo = req.url;
      req.session.returnToMethod = req.method;
      req.flash('login.danger', req.session.reauthenticate ? 'You need to login again to access this page.' : 'You need to login to access this page.');
      res.redirect('/login');
      return;
    }
  
    if (config.requireEmailVerification
        && req.user && !req.user.local.verified) {
      if (config.requireEmailVerification == 'nag') {
        req.flash('warning', 'Please confirm your email address by clicking the link sent to <strong>'+ req.user.local.email +"</strong>.&nbsp;&nbsp;<a class='send-resend' href='#'>Resend confirmation email</a>.");
      } else if (config.requireEmailVerification == 'require') {
        // redirect to the email verification page
        req.session.returnTo = req.url;
        req.session.returnToMethod = req.method;
        res.redirect('/verification-required');
        return;
      }
    }
  
    return next();
  }
docs: route middleware to make sure a user is logged in