You probably need to add an else statement for your last call to done() as indicated in this snippet:
if (len === 2) {
if (!exports.User.verifyPassword(password, user.password)) {
return done(err, false);
} else {
return done(err, user);
}
} else if (len === 3) {
exports.User.verifyPassword(password, user.password, function(err, isMatch) {
return done(err, !err && isMatch ? user : false);
});
}
else {
// Added an ELSE statement here
return done(err, false);
}
Without this else statement the call to exports.User.verifyPassword() will be made AND the call to return done(err,false)...and then eventually a second call to done() will be made when verifyPassword() calls the callback that you gave it.
The second call to done() is what is probably producing the headers have been set error.