CouchDB/PouchDB has very clunky auth so IMO it's better to roll your own auth and either use a reverse proxy with a JWT or else hide the DB behind an API service.