If the access manager is unable to authenticate the message, it never reaches the receiver.
I've got the Passport session, but I'm still unable to authenticate from the client script (it only works in pages hosted by my node app directly).