Yeah, @humph wasn't happy with combining the two cases into one response, so now it's become (pseudocoded):

```javascript
if ( error ) {
  // return 500 code
}

if ( !user ) {
  // return 404
}
```

I AM making the assumption that an error will be null when no user is found.  I should probably confirm that though...