    accessToken: chance.hash(),
    role: postData.aRole
  })

  if (postData.aTitle) {
    account.title = postData.aTitle
  }

  account.save(function (err, a) {
    if (err) {
      response.success = false
      response.error = err
      winston.debug(response)
      return res.status(400).json(response)
    }

    a.populate('role', function (err, populatedAccount) {
      if (err) return res.status(500).json({ success: false, error: err })

      response.account = populatedAccount.toObject()
      delete response.account.password

      const groups = []

      async.each(
        postData.aGrps,
        function (id, done) {
          if (_.isUndefined(id)) return done(null)
          groupSchema.getGroupById(id, function (err, grp) {
            if (err) return done(err)
            if (!grp) return done('Invalid Group (' + id + ') - Group not found. Check Group ID')

            grp.addMember(a._id, function (err, success) {
              if (err) return done(err)

              grp.save(function (err) {
                if (err) return done(err)
                groups.push(grp)
                done(null, success)
              })
            })
          })
        },
        function (err) {
          if (err) return res.status(400).json({ success: false, error: err })
          response.account.groups = groups
          return res.json(response)
        }
      )
    })
  })
}
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.