Could you separate out these error cases? If we get `err` we probably want to send a 500, but if we get a 404 then there's no user by the email available, right?