Basic user/group handler, with express.js/mongoose