[JsonWebTokenError: invalid signature]

This appears when using the authenticate middleware used for certain serverside routes (e.g. creating excerpts). The most common cause is a difference in jwtSecret between when a token was originally signed and when it is decoded. In this particular instance, it happened because when a token was signed after login in controllers/auth.js, it was being signed with the wrong secret. This was fixed by changing this line:

    var jwtSecret = process.env.JWT_SECRET || 'mysecret';

to this:

    var jwtSecret = process.env.JWT_SECRET || config.jwtSecret;