user.reset_password_token = require('crypto').randomBytes(32).toString('hex');

User.findOne({ email: req.body.username }, function(err, user) {

  crypto.randomBytes(256, function(ex, buf) {
    if (ex) throw ex;
    user.reset_password_token = buf.toString('hex');
  });

  user.save(); // can I do this here?

  //will user.reset_password_token be set here??
  // Or do I need to put all this code into the randomBytes callback...
  //Can I continue programming the .findOne() callback here
    // with the expectation that
  //user.reset_password_token is set?
  //Or am I out of bounds...for the crypto callback to have been called reliably.
});

//will user.reset_password_token be set here?

User.findOne({ email: req.body.username }, function(err, user) {

  crypto.randomBytes(256, function(ex, buf) {
    if (ex) throw ex;
    user.reset_password_token = buf.toString('hex');

    // only within this scope will user.reset_password_token be
    // set as expected
    user.save();
  });

  // undefined since this code is called before the crypto call completes
  // (at least when you call crypto async like you have)
  console.log(user.reset_password_token);
});