this is suspicious - no argument callback is probably a wrong callback. The error callback should probably be `if (err || !user)` or something; we should not need three cases here, just two.