It was a problem with the callback of async methods.

Sync methods can run done(new Error('you are not authenticated')); but async methods must call throw new Error('you are not authenticated');. The done parameter is not useful here.