The choice of using an environment var with this name makes a lot of 401 auth erros simply because no mater what you put on auth.js, the code will always revert the the logged in windows USERNAME and the authentication in Office365 will only work if the developer is testing with his own corporate account.
Related issues:
#32
#4
#43
Using another convention solves this: e.g. USRNAME