code: function addJwtHandling(secrets, app) {
  
    if (!secrets.authTokenSecret) {
      log.error(
        'Cannot setup token authentication because token secret is not configured.'
      );
      return;
    }
  
    app.use(expressJwt({
      secret: secrets.authTokenSecret
    }));
  
    app.use(function (req, res, next) {
  
      if (req.user && req.user.data) {
  
        req.user.isAuthenticated = true;
        req.user.meta = req.user.meta || {};
      }
      next();
    });
    app.use(function (err, req, res, next) {
      if (err.name === 'UnauthorizedError') {
        if (err.code === 'credentials_required') {
          // If the caller did not provide credentials, we'll just consider this
          // an unauthenticated request.
          next();
        } else {
          res.status(401).send('Invalid token: ' + err.message);
        }
      }
    });
  }
docs: Adds the handling of Json Web Tokens. If a request comes with a JWT, we set the user accordingly. Improper or expired JWT results in a 401. If no JWT is submitted, however, we let this through, just without setting the user field on the request.