App still let's user type in any username and password and accepts it

In my app I decided to add a bit of security by trying to restrict the user to enter the right password and name but the user still can enter the any name and password and get access to the files .

Screenshot of the user getting access to the files without name and password

'use strict'

const express = require('express')
const fs = require('fs')
const https =require('https')
const path = require('path')

const app = express()
const directoryToServe = 'client'
const port = 3443

var _ = require("lodash");
var bodyParser = require("body-parser");
var jwt = require('jsonwebtoken');

var passport = require("passport");
var passportJWT = require("passport-jwt");

var ExtractJwt = passportJWT.ExtractJwt;
var JwtStrategy = passportJWT.Strategy;


var users = [
  {
    id: 1,
    name: 'jonathanmh',
    password: '%2yx4'
  },
  {
    id: 2,
    name: 'test',
    password: 'test'
  }
];


var jwtOptions = {}
jwtOptions.jwtFromRequest = ExtractJwt.fromAuthHeader();
jwtOptions.secretOrKey = 'tasmanianDevil';


var strategy = new JwtStrategy(jwtOptions, function(jwt_payload, next) {
  console.log('payload received', jwt_payload);
  // usually this would be a database call:
  var user = users[_.findIndex(users, {id: jwt_payload.id})];
  if (user) {
    next(null, user);
  } else {
    next(null, false);
  }
});

passport.use(strategy);

//var app = express();
app.use(passport.initialize());

// parse application/x-www-form-urlencoded
// for easier testing with Postman or plain HTML forms
app.use(bodyParser.urlencoded({
  extended: true
}));

// parse application/json
app.use(bodyParser.json())


app.use('/',express.static(path.join(__dirname,'..',directoryToServe)))

const httpsOptions = {
  cert: fs.readFileSync(path.join(__dirname,'ssl','server.crt')),
  key: fs.readFileSync(path.join(__dirname,'ssl','server.key'))
}

https.createServer(httpsOptions, app)
.listen(port, function()
{
  console.log(`Serving the ${directoryToServe}/directory at https://localhost:${port}`)})

var bodyParser = require('body-parser');


app.use(bodyParser.json());

app.get('/',  function(request, response) {
  response.writeHead(200, {"Content-Type": "text/plain"});
  response.end("We're up and running!!!");
});


var plan = require('./api/planner/index');

//app.get('/api/planner',plan.index);
app.get("/api/planner",plan.index, function(req, res) {
  if(req.body.name && req.body.password){
    var name = req.body.name;
    var password = req.body.password;
  }
  // usually this would be a database call:
  var user = users[_.findIndex(users, {name: name})];
  if( ! user ){
    res.status(401).json({message:"no such user found"});
  }

  if(user.password === req.body.password) {
    // from now on we'll identify the user by the id and the id is the only personalized value that goes into our token
    var payload = {id: user.id};
    var token = jwt.sign(payload, jwtOptions.secretOrKey);
    res.json({message: "ok", token: token});
  } else {
    res.status(401).json({message:"passwords did not match"});
  }
});
app.post('/api/planner',plan.create);
app.put('/api/planner/:id',plan.update);
app.delete('/api/planner/:id',plan.delete);




console.log("Server running at http://127.0.0.1:8000/");
//

via Russkiy