Authentication is against first user in MongoDB even if email does not match

I'm using CompoundJS with MongoDB with the local strategy.  The way the code for compound-password is written, it adopts the default findOrCreate method on User from the CompoundJS framework, although it provides a shim in user.js.  findOrCreate accepts a query such as {where: {email: "foo@bar.com"}}.  It just so happens that if the query omits the "where" as in {email:"foo@bar.com}, it matches the first entry in the User collection.  This is the way the local strategy is written right now.

Thus it always authenticates against the first user in the User collection regardless of email.

I'm trying to figure out the right way to fix this.