Bound the user module to the functions to fix the scoping issue
Correctly retrieve posted variables from req, not res