NIT: I would use an early return here (and in other cases like this):

```js
if (err)
  return res.render('auth/login.html', { 
    username: username, 
    errors: [err] 
  });
return redirectUser(req, res, user);
```