user-router-index.js

router.post('/signin', function (req, res) {  
  User
    .findOne({ email: req.body.email }, function(err, user) {
      if(user && user.__password.salt) {
        pass.hash(req.body.password, user.__password.salt, function(err, hash) {
          if(user.__password.hash == hash) {
            req.session._userId = user._id;
            res.json(user);
          } else {
            res.send(401);
          }
        });
        if(err) {
          //do something
        }
      }
    });
});