Authentication for SocketIO and REST APIs

app.js

var app = feathers()
  .configure(feathers.rest())
  .configure(feathers.socketio(function(io) {
    io.use(function(socket, next) {
      socket.feathers.user = socket.request.session.user;
      next();
    });
  }))
  .use(function(req, res, next) {
    req.feathers.user = req.session.user;
    next();
  })
  .use('/todos', {
    create: function(data, params, callback) {
      if(!params.user || !params.user.isAdmin) {
        return callback(new Error('You are not allowed to create Todos'));
      }
    }
  });