Passport.js (mostly by word of mouth, I only used it breifly) seems like a robust sign in solution.