/**
 * Check the user's password
 */
userSchema.methods.comparePassword = function(candidatePassword, cb) {
    bcrypt.compare(candidatePassword, this.password, function(err, isMatch) {
        if (err) {
            return cb(err);
        }
        cb(null, isMatch);
    });
};

User.findOne({
    username: username
}, function(err, user) {
    if (err) throw err;
    if (!user) {
        return done(null, false, {
            message: 'Unknown USER'
        });

    }
    /**
     * Check the user's password
     */
    User.comparePassword(password, user.password, function(err, isMatch) {
        if () throw err;
        if (isMatch) {
            return done(null, user);
        } else {
            return done(null, false, {
                message: 'Invalid password'
            });
        }
    });
});