This `if` block is a bit weird; I think it reads cleaner as:

```js
if (err || !result) {
    res.json(500, {error: err || 'db_error'});
    return done();
}
fbData.user = result.username
...
```

You don't need to check if `username` exists, by the way. If the result is valid but the username is missing, we have bigger problems.