function isAuthenticated(req, res, next){
  var token = req.body.token || req.query.token || req.headers.authorization; // mengambil token di antara request
  if(token){ //jika ada token
    jwt.verify(token, 'jwtsecret', function(err, decoded){ //jwt melakukan verify
      if (err) { // apa bila ada error
        res.json({message: 'Failed to authenticate token'}); // jwt melakukan respon
      }else { // apa bila tidak error
        req.decoded = decoded; // menyimpan decoded ke req.decoded
        next(); //melajutkan proses
      }
    });
  }else { // apa bila tidak ada token
    return res.status(403).send({message: 'No token provided.'}); // melkukan respon kalau token tidak ada
  }
}

router.get('/test',isAuthenticated, function(req, res, next){
  res.json({succes:true});
});

router.post('/test2', function(req, res, next){
  if (req.body.userId === "cantik") {
    if (req.body.userPassword === 'cewek') {
      var token = jwt.sign(req.body, 'jwtsecret', { // melakukan generate token di jwt
        algorithm: 'HS256'
      });
      res.json({succes: true, token: token});
    }else {
      res.json({succes: true, message: 'password salah'});
    }
  }else {
    res.json({succes: false, message: 'username salah'});
  }
});