Wow! Thanks for giving this a try!
blockstack.js sends authentication requests to the Blockstack Portal, not the Blockstack Core node. Blockstack Portal is where a user's private keys and identity are stored. It generates the authentication request and sends it back to the requesting app which then verifies it. One step of verifying the authentication response is making sure the username claimed in the response is owned by the same bitcoin address as the private key that signs the response. This is achieved by using a trusted Blockstack Core node.
We're putting together these pieces this week so that people will be able to log into this forum using Blockstack. Once that is done, hopefully it will be clearer to everyone how it works. We'll also be in a better position to write better documentation.
Sneak peak: https://twitter.com/larrysalibra/status/842263483207061504