code: function authDetectionMiddleware(req, res, next) {
      logger.debug('Running Auth Detection Middleware...', req.body);
  
      if (req.headers['token']) {
        try {
          req.user = encryption.decode(req.headers['token'], config.secret);
          req.session = { user: req.user };
        } catch (ex) {
          logger.logError('Unexpectedly could not decode a token.', ex);
          res.status(401).send();
          // ensure no user is authenticated.
          req.user = null;
          req.session = { user: null };
        }
        if (!req.user.id) throw 'AUTH FAILED:USER HAS NO MEMBER: id';
        if (!req.user.tokenExpiry || req.user.tokenExpiry <= new Date().getTime()) {
          logger.log('Expired Token:', req.user);
          res.status(401).send({errorCode: 'expired token'});
        }
        else {
          logger.log('Authenticated User:', req.user.id);
          next();
        }
      } else {
        //logger.debug('Checking permissions to ', req.path);
        //if (config.routesNotRequiringAuthentication[req.path]) next();
        //else if (m.isPublicRoute(req.path)) next();
        //else {
        //  logger.debug('Disallowing request to:', req.path);
        //  res.status(401).send();
        //}
        if (config.authenticatedRoutes[req.path] || !m.isPublicRoute(req.path))
          res.status(401).send();
        else
          next();
      }
    }
docs: Detects if the user is sending an authenticated request.  If it is, it will set req.user and req.session.user details.
  @param req
  @param res
  @param next