Actually, on further inspection, are we sure this is async? The validate gets called only once the user object has successfully been found and retrieved from db, so all the data should be there.

The above code, for example, fails because it doesn't return a result in time, so the call to validatepassword fails and the user is stuck with a bad password notification.