Spotify WebApp session is the same for all?

Question

I have created a web app using the Spotify Web API and NodeJS server-side. The / route checks for a null authorisation token (the one provided by S