some fixes to the auth and lockouts

map/app/middleware/auth.js

@@ -43,7 +43,6 @@ const checkTempUserExpiration = async (req, res) => {
 };
 
 const requireAuth = async (req, res, next) => {
-    // Check for both authentication patterns used in your app
     const isAuthenticated = (req.session && req.session.authenticated) || 
                            (req.session && req.session.userId && req.session.userEmail);
     
@@ -67,9 +66,22 @@ const requireAuth = async (req, res, next) => {
         logger.warn('Unauthorized access attempt', {
             ip: req.ip,
             path: req.path,
-            userAgent: req.get('User-Agent')
+            userAgent: req.get('User-Agent'),
+            referer: req.get('Referer'), // Add referer to see where requests come from
+            method: req.method,
+            timestamp: new Date().toISOString()
         });
         
+        // Check if this is an auto-refresh request
+        if (req.headers['x-requested-with'] === 'XMLHttpRequest' || 
+            req.path.includes('/api/locations')) {
+            return res.status(401).json({
+                authenticated: false,
+                error: 'Session expired',
+                isAutoRefresh: true
+            });
+        }
+        
         if (req.xhr || req.headers.accept?.indexOf('json') > -1) {
             res.status(401).json({ 
                 success: false, 

map/app/middleware/rateLimiter.js

@@ -11,8 +11,12 @@ const keyGenerator = (req) => {
 // General API rate limiter
 const apiLimiter = rateLimit({
     windowMs: 15 * 60 * 1000, // 15 minutes
-    max: 300, // Increased from 100 to 300 to accommodate auto-refresh and multiple users
+    max: 300, // Already increased
     keyGenerator,
+    skip: (req) => {
+        // Skip rate limiting for authenticated users (or increase their limit)
+        return req.session?.authenticated === true;
+    },
     standardHeaders: true,
     legacyHeaders: false,
     trustProxy: true, // Explicitly trust proxy