In user.js, there should be another API that verifies whether the token is valid... so far, I do not see this here. It trusts what is written to localStorage and immediate 'trust' user should be login and I think this is wrong.
How to test... Launch the app, register the users... then go to Mongo and delete the user without logining out. Now refresh the page. You see the that app keep doing the spinning wait.