There's a newer version of this sample taking advantage of passport-azure-ad.
Check it out: JavaScript single-page application calling a protected Node.js web API;
If you really need to access this sample, you can navigate to the master branch, but please know that it's no longer maintained.