User-logging authentication
Interesting question,

I think the first thing to do is read this.

You could replace this:

if (req.url.indexOf(API_PATH) == 0){
  //Lots of code
}else{
  next();
}


To 

if (req.url.indexOf(API_PATH) != 0){
  next();
  return;
}
//Lots of code,with one less level of indentation


This early exit makes the rest of the code look less busy.

Furthermore, in cases like this

req.logger.log('error', 'Error authenticating', {
  error: {
    message: e.message,
    stack: e.stack
  }
});


You should notice that the object you build has the exact same property names as in the e object, you might as well do the the far cleaner

req.logger.log('error', 'Error authenticating', { error: e });


On a side note, I would also log invalid log-ins, this way you can detect when someone might be trying to hack in to your system.

You can remove some of the arrowness here as well:

                    .then(function(pnpUserIdResult){
                        pnpUserId = pnpUserIdResult;
                        return user.findByPnpID(pnpUserIdResult);
                    })
                    .then(function(userData){

                        if(userData._id){
                            return storeUserIdInRequest(req, next, userData._id.toString());
                        }else{
                            var newUser = {
                                pnpId: pnpUserId,
                                radius: 1000
                            };
                            return user.create(newUser)
                                .then(function(userData){
                                    return storeUserIdInRequest(req, next, userData._id);
                                });
                        }


I am not sure why you need 2 then's, so I will just merge them.

                    .then(function(pnpUserIdResult){
                        pnpUserId = pnpUserIdResult;
                        var userData = user.findByPnpID(pnpUserIdResult);
                        if(userData._id){
                            return storeUserIdInRequest(req, next, userData._id.toString());
                        }
                        return user.create({
                            pnpId: pnpUserId,
                            radius: 1000
                        }).then(function(userData){
                            return storeUserIdInRequest(req, next, userData._id);
                        });


From a naming perspective;


I get really annoyed by the pnp acronym all over the place, it should be established on top that this for pnp and then you can just go with user and userId or user.id
paynopain &lt;- this is a meaningless name, why would it have getIdFromAccessToken?
var user = new User(req.logger);, whatever user is here, it does not represent a user since you only use it for findByPnpID..
radius: 1000, what does radius mean for a user ? What does 1000 mean ?


Finally, for storeUserIdInRequest (which lies about what it does), you dont have to wait for the cache to be set, you can simply (and this should be faster) do

function storeUserIdInRequest(req, next, userId){
  cache.write('pnpToken:' + req.params.pnp_access_token, userId, {
      expire: 60 * 60 //1 hour in seconds
  });
  req.userId = userId;
  req.logger.setExtra({
    userId: userId
  });
  next();
}