I believe you might be mistaken - if you sign in on persona, `req.session.email` will equal **your** email, "jon@example.com" lets say, making line 92 equivalent to:

```
loginAPI.getUser( "jon@example.com", function ( err, user ) {
...
});
```

In that case, if you navigated to `http://example.org/user/ksedge`, the checks would look like this:

```
if (
     ( jonsUniqueUsername === ksedge ) || // false
     ( jonsUniqueEmail === ksedge ) ||         // false
     ( jonsUniqueID === ksedge )                 // false
   )
{
   req.session.username = ksedge;  // not hit
}
```
 
Wouldn't they?