          accessToken: chance.hash(),
          role: postData.aRole
        })

        if (postData.aTitle) {
          account.title = postData.aTitle
        }

        account.save(function (err, a) {
          if (err) return next(err)

          a.populate('role', function (err, populatedAccount) {
            if (err) return next(err)

            response.account = populatedAccount.toObject()
            delete response.account.password

            const groups = []

            async.each(
              postData.aGrps,
              function (id, done) {
                if (_.isUndefined(id)) return done()
                groupSchema.getGroupById(id, function (err, grp) {
                  if (err) return done(err)
                  if (!grp) return done({ message: `Invalid Group (${id}) - Group not found. Check Group ID.` })

                  grp.addMember(a._id, function (err, success) {
                    if (err) return done(err)

                    grp.save(function (err) {
                      if (err) return done(err)
                      groups.push(grp)
                      done(null, success)
                    })
                  })
                })
              },
              function (e) {
                if (e) return next(e)
                response.account.groups = groups

                return next()
              }
            )
          })
        })
      }
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.