            accessToken: chance.hash()
          },
          function (err, user) {
            if (err) return apiUtil.sendApiError(res, 500, err.message)

            savedId = user._id

            return user.populate('role', next)
          }
        )
      },
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.