     if body.password?
         user.getUser (err, user) ->
             if err
-                console.log "[Merge] err: #{err}"
+                console.log "[updateKeys] err: #{err}"
                 send 500
             else
-                slaveKey =
-                    crypto.decrypt app.crypto.masterKey, app.crypto.slaveKey
-                salt = crypto.genSalt(32 - body.password.length)
-                app.crypto.masterKey =
-                    crypto.genHashWithSalt body.password, salt
-                app.crypto.slaveKey =
-                    crypto.encrypt app.crypto.masterKey, slaveKey
-                data = slaveKey: app.crypto.slaveKey, salt: salt
-                db.merge user._id, data, (err, res) =>
-                    if err
-                        console.log "[Merge] err: #{err}"
-                        send 500
-                    else
-                        send 200
+                if app.crypto? and app.crypto.masterKey? and
+                        app.crypto.slaveKey?
+                    slaveKey =
+                        crypto.decrypt app.crypto.masterKey, app.crypto.slaveKey
+                    salt = crypto.genSalt(32 - body.password.length)
+                    app.crypto.masterKey =
+                        crypto.genHashWithSalt body.password, salt
+                    app.crypto.slaveKey =
+                        crypto.encrypt app.crypto.masterKey, slaveKey
+                    data = slaveKey: app.crypto.slaveKey, salt: salt
+                    db.merge user._id, data, (err, res) =>
+                        if err
+                            console.log "[updateKeys] err: #{err}"
+                            send 500
+                        else
+                            send 200
+                else
+                    console.log "[updateKeys] err: masterKey and slaveKey don't\
+                        exist"
+                    send 500
     else
         send 500
 
 
 #DELETE /accounts/
 action 'deleteKeys', ->
-    app.crypto.masterKey = null
-    app.crypto.slaveKey = null
-    send 204
+    if app.crypto? and app.crypto.masterKey and app.crypto.slaveKey
+        app.crypto.masterKey = null
+        app.crypto.slaveKey = null
+        send 204
+    else
+        console.log "[updateKeys] err: masterKey and slaveKey don't exist"
+        send 500
+
 
 
 #POST /account/
 action 'createAccount', ->
     @body = body
     body.docType = "Account"
-    encryptPassword (pwdExist) ->
-        if pwdExist
-            db.save @body, (err, res) ->
-                if err
-                    railway.logger.write "[Create] err: #{err}"
-                    send 500
-                else
-                    send _id: res._id, 201
-        else
-            send 401
+    encryptPassword (pwdExist, err) ->
+        if err
+            console.log "[createAccount] err: #{err}"
+            send 500
+        else
+            if pwdExist
+                db.save @body, (err, res) ->
+                    if err
+                        railway.logger.write "[Create] err: #{err}"
+                        send 500
+                    else
+                        send _id: res._id, 201
+            else
+                send 401
 
 
 #GET /account/:id

                data = salt: salt, slaveKey: encryptedSlaveKey
                db.merge user._id, data, (err, res) =>
                    if err
                        console.log "[Merge] err: #{err}"
                        send 500
                    else
                        send 200

# helpers
encryptPassword = (callback)->
    if @body.password
        if app.crypto? and app.crypto.masterKey and app.crypto.slaveKey
            slaveKey = crypto.decrypt app.crypto.masterKey, app.crypto.slaveKey
            newPwd = crypto.encrypt slaveKey, @body.password
            @body.password = newPwd
            @body.docType = "Account"
            callback true
        else
            callback false, new Error("master key and slave key don't exist")
    else
        callback false

