While generating a list of users and passwords, it seems that the check against the hash is being done with case sensitivity. The output string of SHA-1 is hexadecimal and therefore not case sensitive.

Admittedly, this is a minor issue, but I figured it was worth noting for anyone running into similar issues.

Issue seems to be inside of routes/auth.js, where an insensitive comparison is being done for the username, but not for the hashed password: https://github.com/claudioc/jingo/blob/master/routes/auth.js#L133-L134