use User.update() rather than req.user.save() - which is unreliable in this case.