using undefined instead of anonymous for non-logged in users
fixing a next(err) function called twice
making various test cases work