Thanks, guys. I made a couple small updates. I added support for CORS and basic authentication using API KEY.
As a sidenote, i wasn't sure where custom code should live, so i created a lib directory.
I also couldn't figure out how to get policies to work the way i wanted, so i left some of that logic
in the lib/authenKey.js file, which is less than ideal.