A Node.js app authenticates against MongoDB by dropping your input directly into a query object. Inject a NoSQL operator to bypass the password check entirely.
