shinecita

router.post('/signin', function (req, res) {  
  User
    .findOne({ email: req.body.email }, function(err, user) {
      if(user && user.__password.salt) {
        pass.hash(req.body.password, user.__password.salt, function(err, hash) {
          if(user.__password.hash == hash) {
            req.session._userId = user._id;
            res.json(user);
          } else {
            res.send(401);