code: function handleLogin(user, req, res, next) {
  
  
      var token;
      var profile;
      var tokenExpiresInMinutes;
      var envelope = {
        data: user,
        isAuthenticated: true,
        meta: {}
      };
  
      // First handle the case where the user was not logged in.
      if (!user) {
        if (authConfig.maintenance === 'cookie') {
          req.logout();
        }
        return res.status(401).send('Wrong password or no such user.');
      }
      // user_id is how it is in the schema
      /* jshint ignore:start */
      // Now handle the case where we did get a user record.
      if (authConfig.maintenance === 'token') {
        // For token authentication we want to add a token.
        profile = {
          username: user.username,
          email: user.email,
          userdata_id: user.userdata_id
        };
        /* jshint ignore:end */
        tokenExpiresInMinutes = authConfig.expiresInMinutes || 60;
        envelope.meta.token = generateToken(profile, tokenExpiresInMinutes,
          secrets.authTokenSecret);
  
        envelope.meta.expires = getExpirationTime(tokenExpiresInMinutes);
        return res.status(200).send(envelope);
      } else if (authConfig.maintenance === 'cookie') {
        // For cookie authentication we want to login the user.
        req.login(user, function (err) {
          if (err) {
            return next(err);
          } else {
            return res.status(200).send(envelope);
          }
        });
      }
    }
docs: depends on auth config