I'm following along in the MEAN machine Node authentication tutorial.
Here is their source code: https://github.com/scotch-io/mean-machine-code/blob/master/10-node-authentication/server.js I basically have everything except for the apiRouter.post('/authenticate', part
The Express APIs are working:
http://localhost:8615/api/users will return a list of users from scotch.io's MongoDB

The following is the API for /api/users:
apiRouter.route('/users')
// create a user (accessed at POST http://localhost:8615/api/users)
.post(function(req, res) {
    // create a new instance of the User model
    var user = new User();
    // set the users information (comes from the request)
    user.name = req.body.name;
    user.username = req.body.username;
    user.password = req.body.password;
    // save the user and check for errors
    user.save(function(err) {
        if (err) {
            // duplicate entry
            if (err.code == 11000) 
                return res.json({ success: false, message: 'A user with that username already exists. '});
            else 
                return res.send(err);
        }
        // return a message
        res.json({ message: 'User created!' });
    });
})
// get all users (access at GET http://localhost:8615/api/users)
.get(function(req, res) {
    User.find(function(err, users) {
        if (err) return res.send(err);
        // return the users
        res.json(users);
    })
});
Here is my user.js User Schema
// SCHEMAS ------------------------------------
// user schema
var UserSchema = new Schema({
    name: String,
    username: { type: String, required: true, index: { unique: true }},
    password: { type: String, required: true, select: false }
    // ^ select false will not return passwords
});
// hash the password before the user is saved
UserSchema.pre('save', function(next) {
    var user = this;
    // PUT username
    if (!user.isModified('username')) return next();
    // PUT name
    if (!user.isModified('name')) return next();
    // hash the password only if the password has been changed or user is new
    if (!user.isModifited('password')) return next();
    // generate the salt
    bcrypt.hash(user.password, null, null, function(err, hash) {
        if (err) return next(err);
        // change the password to the hashed version
        user.password = hash;
        next();
    });
});
FROM THE BOOK:
Create a Sample User
First, we need to make sure that we even have a user to authenticate since towards the end of last chapter, we deleted everyone. Let’s create the user using the POST http://localhost:8080/api/users route we created in our API to add a user to our database.
We will send a POST request with the following information: Name Chris Username chris Password supersecret
I'm using Postman to add a new user, as you can see I have put in key/value pairs for username and password, however getting an error saying "Validation failed" "username is required" "password is required":

UPDATE, I just tried x-www-form-urlencoded and got the following error
GET /api/users 200 66.141 ms - 655
••• API CRUD hit •••
/Users/leongaban/NodeDallas/projects/awesome-test/app/models/user.js:27
    if (!user.isModifited('password')) return next();
          ^
TypeError: Object { password: 'supersecret',
  username: 'Chris',
  name: 'chris',
  _id: 54c001dc4ee4028c18e61334 } has no method 'isModifited'
at model.UserSchema.methods.comparePassword.user (/Users/leongaban/NodeDallas/projects/awesome-test/app/models/user.js:27:12)
Screenshot of error in Postman: https://s3.amazonaws.com/f.cl.ly/items/1M0M392M0E3b2i430I1n/Image%202015-01-21%20at%201.45.51%20PM.png
 
     
    