text: var User = require('../models/user');
  var jwt = require('jsonwebtoken'); // used to create, sign, and verify tokens
  var config = require('../config.js');
  
  exports.getToken = function (user) {
      return jwt.sign(user, config.secretKey, {
          expiresIn: config.accessTokenLifetime
      });
  };
  
  exports.verifyOrdinaryUser = function (req, res, next) {
      // check header or url parameters or post parameters for token
      var token = req.body.token || req.query.token || req.headers['x-access-token'];
  
      // decode token
      if (token) {
          
          // verifies secret and checks exp
          jwt.verify(token, config.secretKey, { ignoreExpiration: true }, function (err, decoded) {
              if (err) {
                  var err = new Error('You are not authenticated!');
                  err.status = 401;
                  return next(err);
              } else {
                  // if everything is good, save to request for use in other routes
                  
                  // Refresh
                  var originalDecoded = jwt.decode(token, {complete: true});
                  var tok = jwt.sign(originalDecoded, config.secretKey, {expiresIn: 10});
                  // console.log(tok);
                  // var originalDecoded = jwt.decode(token, {complete: true});
                  // var refreshed = jwt.refresh(originalDecoded, 3600, config.secretKey);
                  
                  req.decoded = decoded;
                  next();
              }
          });
      } else {
          // if there is no token
          // return an error
          var err = new Error('No token provided!');
          err.status = 403;
          return next(err);
      }
  };
  
  exports.verifyAdmin = function (req, res, next) {
      // verifies if is admin
      if (req.decoded._doc.admin == true) {
          next();
      } else {   
          // if not admin return an error
          var err = new Error('You are not authorized to perform this operation!');
          err.status = 403;
          return next(err);
      }
  };