     app.get '/badges/:badge_id/seen', (req, res, next) ->
       badgeId = req.params.badge_id
       username = req.query.username
-      User.findOne {username: username}, (err, user) ->
+      email = req.query.email
+      unless username? || email?
+        res.status(404).send("Not Found")
+        return
+
+      User.findByUsernameOrEmail username, email, (err, user) ->
         badge = _.detect user.badges, (b) -> b._id.toString() == badgeId
         badge.seen = true
         user.save ->

    app.get '/badges/:badge_slug/destroy', (req, res, next) ->
      badgeSlug = req.params.badge_slug
      username = req.query.username
      User.findOne {username: username}, (err, user) ->
        badge = _.detect user.badges, (b) -> b.slug == badgeSlug
        if badge? && user?
          badge.remove()

    # Show newly awarded badges
    app.get '/badges/has_new_badges.:format?', (req, res, next) ->
      username = req.query.username
      email = req.query.email
      unless username? || email?
        res.status(404).send("Not Found")
        return

      User.findByUsernameOrEmail username, email, (err, user) ->
        badges = _.select user.badges, (badge) -> !badge.seen

        formatResponse req, res, {has_new_badges: badges.length > 0}
