server/middleware/auth.js
function tokenToCookie(req, res, next) {
  if (req.signedCookies.authorization !== req.accessToken.id) {
    let opt = _cookieOpt(req, res);
    res.cookie('authorization', req.accessToken.id, opt);
  }
  next();
}
function tokenToCookie(req, res, next) {
  if (req.signedCookies.authorization !== req.accessToken.id) {
    let opt = _cookieOpt(req, res);
    res.cookie('authorization', req.accessToken.id, opt);
  }
  next();
}
/* Access token live time prolongation
@see: https://github.com/strongloop/loopback/issues/257
function prolong(token, next) {
var now = new Date(),
createTS = token ? token.created.getTime() : 0,
expiredTS = token ? token.ttl * 1000 : 0,
dayTS = 24 * 60 * 60 * 1000;

expired token
if (createTS + expiredTS < now) return next();

if (now.getTime() - createTS < dayTS) {
create today
return next();
}
update date created to now (extend expire date)
token.updateAttribute('created', now, next);
} /* although we don't rely much on cookies, we save last request auth in cookie
in case they refresh page