function handleAuth(err, user, info) {
    const detail = info && info.message;
    if (err) {
      return next(err);
    }
    if (!user) {
      return res.utils.unauthorized(detail);
    }
    // When called without creating a session, no callback is used
    req.logIn(user, { session: false });
    return next();
  }
A custom passport authenticate handler to control shape of response
Passport otherwise responds with a 401 when not authenticated
To keep this response consistent with other APIs, this formats error accordingly
@param {*} err
@param {*} user
@param {*} info