// Let's check if the user provided valid credentials. Of course, you'd use a database or some third-party service
  // for this!
  if (!(req.body.email === '<mailto:foo@bar.com|foo@bar.com>' && req.body.password === 'foobar')) {
    // Looks like the user provided invalid credentials, let's show the ui again...

    res.render('login', {
      csrfToken: req.csrfToken(),
      challenge: challenge,
      error: 'The username / password combination is not correct'
    })

    return
  }