I think it makes more sense to call out the failure case, and have the default case be a straight through:

```javascript
if ( credentials ) {
  if ( !hawk.client.authenticate( res, credentials, header.artifacts, { payload: JSON.stringify( body ) } ) ) {
    return callback( { error: "WARNING: THE RESPONSE DOES NOT AUTHENTICATE - YOUR TRAFFIC MY BE GETTING INTERCEPTED AND MODIFIED" } );
  }
  // credentials look good
  return callback( null, body );
} 
```

Also note, you've fallen into the multi-callback error here, by not doing `returns` on those callbacks