Learn Authentication the Hard Way (Andrew Best):
Authentication on the Client Side the Right Way: Cookies vs. Local Storage (Tania Rascia).
Your Node.js authentication tutorial is (probably) wrong: "I went on a search of Node.js/Express.js authentication tutorials. All of them were incomplete or made a security mistake in some way..."