Example using validator.js

update: function (req, res) {
        validator.check({
            required: [
                validator.rulesUserSessionId(req.session.user.id)
            ],
            optional: [
                {
                    rule: validator.rulesEmail(req.param('email')),
                    value: req.param('email')
                }, {
                    rule: validator.rulesPassword(req.param('password')),
                    value: req.param('password')
                }
            ]
        }, function(errors, valuesChecked){
            if(!_.isEmpty(valuesChecked)){
                User.findOne(req.session.user.id, function(err, user){
                    if(err){
                        return res.json({message: 'DB error.', data: {code: '100', err: err}, status: false});
                    }
                    if(user = dbHelper.merge(user, valuesChecked, ['password'])){
                        user.save(function(err){
                            if(err){
                                return res.json({message: 'DB error.', data: {code: '100', err: err}, status: false});
                            }

                            return res.json({message: 'User updated.', data: {user: user}, status: true});
                        });
                    }else{
                        // User not founded.
                        return res.json({message: 'User don\'t exists.', data: {}, status: false});
                    }
                });
            }else{
                return res.json({message: 'No values send. No change.', data: {user: req.session.user}, status: true});
            }
        }, res);
    },