Login and sessions

This example stores a random session id in a cookie and keeps the session data on the server. Passwords are hashed with scrypt from node:crypto. A guard checks the CSRF token of every form and looks up the session for all routes below it. Users and sessions live in memory, so they are gone after a restart.