title: Why am I getting a 401 response in my tests?
body: <p>I am trying to test a route with authentication in my Node / Express / Mongoose back-end.</p>
  
  <p>Here's the test file</p>
  
  <pre><code>    var should = require('should');
      var _ = require('lodash');
      var async = require('async');
      var app = require('../../../../app');
      var request = require('supertest');
      var mongoose = require('mongoose');
      var User = mongoose.model('User');
      var Firm = mongoose.model('Firm');
      var firm, user, userPassword, createdFirm, loggedInUser;
  
      describe('GET /api/firms', function(){
  
      beforeEach(function (done) {
  
          firm = new Firm({ 
              company: 'My test company', 
              corporateMail: 'test.com' 
          });
  
          userPassword = 'password';
          user = new User({
              fistname: 'Fake User',
              lastname: 'Fake User',
              email: 'test@test.com',
              job: 'Partner',
              firmName:firm.company,
              password:userPassword,
              isActivated:true,
              _firmId:firm._id
          });   
  
          function createFirm(cb){
              request(app)
                  .post('/api/firms')
                  .send(firm)
                  .expect(201)
                  .end(function(err, res){
                      if ( err ) throw err;
                      createdFirm = res.body;
                      cb();
                  });
          }
  
          function createUser(cb){
              request(app)
                  .post('/api/common/users')
                  .send(user)
                  .expect(200)
                  .end(function(err, res){
                      createdUser = res.body;
                      if ( err ) throw err;
                      cb();
                  });
          };
  
          async.series([function(cb){
              createFirm(cb);
          }, function(cb){
              createUser(cb);
          }], done);    
  
      });
  
  
      afterEach(function (done) {
          firm.remove();
          user.remove();
          done();
      });
  
      it('should respond with 401 error', function(done) {
          request(app)
            .get('/api/firms')
            .expect(401)
            .end(function(err, res) {
              if (err) return done(err);
              done();
            });
      });
  
      it('should login', function(done) {
          request(app)
            .post('/auth/local')
            .send({email:user.email, password:user.password})
            .expect(200)
            .end(function(err, res) {
              if (err) return done(err);
              done();
            });
      });
  
      it('should respond with 200 after login', function(done) {
          request(app)
            .get('/api/firms')
            .expect(200)
            .end(function(err, res) {
              if (err) return done(err);
              done();
            });
      });
  </code></pre>
  
  <p>});</p>
  
  <p>In the workflow the <code>firm</code> object is created first and then returns its Id so I can create the user with the <code>firmId</code> as a reference. </p>
  
  <p>I would like to test the /api/firms route after the user is authenticated but in spite of my various attempts (using superagent, logging in the <code>before</code> section) I always get a 401 response in the last <code>should</code> section instead of an expected 200.</p>