"Because it's node.js it has these permissions" -- not generally. Program Files generally always needs administrator permissions to write.
I'm confused with this statement. Not because of the facts is has but because you quoted something and I was looking for me saying that in the post but I didn't. I didn't imply Program Files anywhere either so I'm confused in the context you made this sentence according to my post. I do get the idea though about #2, which is probably the way I would go.
Interesting on the login token. I guess I just assumed all my game servers would have access to the central users database but this is something I'll look into, thank you.