And these days ES6/ES7 makes Javascript very palatable indeed. Check it out :-)
You have one 'Universal Application', and then you have two small entry points: - server.js is a small (express) server to send a HTTP response to the client (server bootstrapping) - client.js renders a page and the mounts it onto a DOM node.
To get around the issues of database access, it makes it a lot easier to put all of that into an API that can be accessed by the server and the client.
Here's a very small project I build (and am continuing to build) to learn about this architecture https://github.com/joshhunt/reactapus
Your project looks like it will be a very helpful resource for learning. Thanks for the link.
You can still use authentication with an API... You don't need direct access to the database to do that.