Simplify utils.hashPassword.
Check if user exists first, then hash password.
Do not push unwanted parameters into callback of revokeAccess.
Move some code around.
Store mtime as integer to avoid conversion.