Better error checking

Make sure that the user object exists before trying to inspect properties on user.

Prior to this change, the failureHandler would never be called because the Express error handler would capture the attempt to reference id on user, which in some cases user is undefined.