A couple security issues after a quick look:

> No secure flag set on your session cookie

> No HttpOnly flag or secure flag set on auth-token cookie

> Password reset doesn't require the old password

> Password policy requires only 6 characters

> No x-frame-options header (especially problematic with 3rd item)

> You're running sslstrip on port 10250

> You're MongoDB port is open to the internet

> No support for TLS 1.1 or 1.2

> Info is "encrypted" but keys are kept server side. You may not keep the URL after generation but it's still sitting in your server logs. Look at mega's use of strings after # for how to do client side only keys.